On 02/10/2019 13:23, Mark Rutland wrote:
> On Wed, Oct 02, 2019 at 12:55:45PM +0100, Colin King wrote:
>> From: Colin Ian King <colin.king@xxxxxxxxxxxxx>
>>
>> Shifting the u32 integer result of (pci_dword & SNR_IMC_MMIO_BASE_MASK)
>> will end up with an overflow when pci_dword greater than 0x1ff. Fix this
>> by casting pci_dword to a resource_size_t before masking and shifting it.
>>
>> Addresses-Coverity: ("Unintentional integer overflow")
>
> I don't see that tag in Documentation/process/submitting-patches.rst ;)
>
> IIUC this is unintented truncation of the upper bits due to missing type
> promotion before the shift, rather than overflow (i.e. the value
> wrapping across addition/subtraction), so I think the wording is
> slightly misleading.
>
> Does coverity call that integer overflow?
Coverity calls it "Unintentional integer overflow". I suspect Coverity
first spots the overflow before the truncation occurs and so flags that
up as the root cause.
>
> It might be better to say:
>
> | [PATCH] perf/x86/intel/uncore: don't truncate upper bits of address
> |
> | Shifting the u32 integer result of (pci_dword & SNR_IMC_MMIO_BASE_MASK)
> | by 23 will throw away the upper 23 bits of the potentially 64-bit
> | address. Fix this by casting pci_dword to a resource_size_t before
> | masking and shifting it.
> |
> | Found by coverity ("Unintentional integer overflow").
>
> Otherwise, the patch looks fine to me:
>
> Acked-by: Mark Rutland <mark.rutland@xxxxxxx>
>
> Thanks,
> Mark.
>
>> Fixes: ee49532b38dd ("perf/x86/intel/uncore: Add IMC uncore support for Snow Ridge")
>> Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx>
>> ---
>> arch/x86/events/intel/uncore_snbep.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
>> index b10a5ec79e48..ed69df1340d9 100644
>> --- a/arch/x86/events/intel/uncore_snbep.c
>> +++ b/arch/x86/events/intel/uncore_snbep.c
>> @@ -4415,7 +4415,7 @@ static void snr_uncore_mmio_init_box(struct intel_uncore_box *box)
>> return;
>>
>> pci_read_config_dword(pdev, SNR_IMC_MMIO_BASE_OFFSET, &pci_dword);
>> - addr = (pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
>> + addr = ((resource_size_t)pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
>>
>> pci_read_config_dword(pdev, SNR_IMC_MMIO_MEM0_OFFSET, &pci_dword);
>> addr |= (pci_dword & SNR_IMC_MMIO_MEM0_MASK) << 12;
>> --
>> 2.20.1
>>
