Commit b75a8440 authored by Nikita Zhandarovich's avatar Nikita Zhandarovich Committed by Wen Zhiwei
Browse files

drm/i915/guc: prevent a possible int overflow in wq offsets 

stable inclusion
from stable-v6.6.52
commit 86238603c8f4df09b2a926617511310fd550737c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAYXOD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=86238603c8f4df09b2a926617511310fd550737c



--------------------------------

[ Upstream commit d3d37f74683e2f16f2635ee265884f7ca69350ae ]

It may be possible for the sum of the values derived from
i915_ggtt_offset() and __get_parent_scratch_offset()/
i915_ggtt_offset() to go over the u32 limit before being assigned
to wq offsets of u64 type.

Mitigate these issues by expanding one of the right operands
to u64 to avoid any overflow issues just in case.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: c2aa552f ("drm/i915/guc: Add multi-lrc context registration")
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: John Harrison <John.C.Harrison@Intel.com>
Signed-off-by: default avatarNikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://patchwork.freedesktop.org/patch/msgid/20240725155925.14707-1-n.zhandarovich@fintech.ru


Reviewed-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
(cherry picked from commit 1f1c1bd56620b80ae407c5790743e17caad69cec)
Signed-off-by: default avatarTvrtko Ursulin <tursulin@ursulin.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent aa80eb72

drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c

+2 −2
Original line number Diff line number Diff line
@@ -2695,9 +2695,9 @@ static void prepare_context_registration_info_v70(struct intel_context *ce, 
		ce->parallel.guc.wqi_tail = 0;

		ce->parallel.guc.wqi_head = 0;



		wq_desc_offset = i915_ggtt_offset(ce->state) +

		wq_desc_offset = (u64)i915_ggtt_offset(ce->state) +

				 __get_parent_scratch_offset(ce);

		wq_base_offset = i915_ggtt_offset(ce->state) +

		wq_base_offset = (u64)i915_ggtt_offset(ce->state) +

				 __get_wq_offset(ce);

		info->wq_desc_lo = lower_32_bits(wq_desc_offset);

		info->wq_desc_hi = upper_32_bits(wq_desc_offset);