lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 187/255] powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
    Date
    From: Chao Qin <chao.qin@intel.com>

    [ Upstream commit 2d93540014387d1c73b9ccc4d7895320df66d01b ]

    When value < time_unit, the parameter of ilog2() will be zero and
    the return value is -1. u64(-1) is too large for shift exponent
    and then will trigger shift-out-of-bounds:

    shift exponent 18446744073709551615 is too large for 32-bit type 'int'
    Call Trace:
    rapl_compute_time_window_core
    rapl_write_data_raw
    set_time_window
    store_constraint_time_window_us

    Signed-off-by: Chao Qin <chao.qin@intel.com>
    Acked-by: Zhang Rui <rui.zhang@intel.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/powercap/intel_rapl_common.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c
    index 925b0004a0ed..d5a505f32260 100644
    --- a/drivers/powercap/intel_rapl_common.c
    +++ b/drivers/powercap/intel_rapl_common.c
    @@ -885,6 +885,9 @@ static u64 rapl_compute_time_window_core(struct rapl_package *rp, u64 value,
    y = value & 0x1f;
    value = (1 << y) * (4 + f) * rp->time_unit / 4;
    } else {
    + if (value < rp->time_unit)
    + return 0;
    +
    do_div(value, rp->time_unit);
    y = ilog2(value);
    f = div64_u64(4 * (value - (1 << y)), 1 << y);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-24 15:35    [W:2.179 / U:0.572 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site