From nobody Tue Dec 2 01:30:37 2025 Received: from forward203b.mail.yandex.net (forward203b.mail.yandex.net [178.154.239.154]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEF832EFD81 for ; Fri, 21 Nov 2025 12:01:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.154 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763726496; cv=none; b=of0hYUvA8iLTHZMPeY0m1a9AAZoUlIbM7U5xlEFkKpzpRFovavbP+YyT6ofSIBGTkaYK4YYCP5QmRKM2zsgC9k10BFqSa+EhWJwOI5ODDg78TXBcYiDTtcUUPpYEL8jroBbH/7R3n0eUCIqxioYL+h4wRQ1/RQKuuhhxU3JslUQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763726496; c=relaxed/simple; bh=4FAoeCXLfNW5EfNBPv3etnMCUnTxVYDY5C8ksbdjRio=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=o9UM6t/yM6JvlIFRkJidi+bg8zHiJ0hNFiO8G39vL2FCwBY4TDLRVaYwd0L+Kv3K5zxXNtFFlPOH9Dnz11We6TmavEF7B03rwp4ZmBYQvotMyIsG/bVLQH7xir2K+VXyUJ6unYK0L1HerXoQB334im76OqTXkQdNgxsPn5pl/4A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=itb.spb.ru; spf=pass smtp.mailfrom=itb.spb.ru; dkim=pass (1024-bit key) header.d=itb.spb.ru header.i=@itb.spb.ru header.b=VchB+89N; arc=none smtp.client-ip=178.154.239.154 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=itb.spb.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=itb.spb.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=itb.spb.ru header.i=@itb.spb.ru header.b="VchB+89N" Received: from forward101b.mail.yandex.net (forward101b.mail.yandex.net [IPv6:2a02:6b8:c02:900:1:45:d181:d101]) by forward203b.mail.yandex.net (Yandex) with ESMTPS id 8C806829CA for ; Fri, 21 Nov 2025 14:56:08 +0300 (MSK) Received: from mail-nwsmtp-smtp-production-main-74.iva.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-74.iva.yp-c.yandex.net [IPv6:2a02:6b8:c0c:9098:0:640:59a5:0]) by forward101b.mail.yandex.net (Yandex) with ESMTPS id 275C1C00EB; Fri, 21 Nov 2025 14:56:00 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-74.iva.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id btWHGr5L4qM0-yTEoVw2u; Fri, 21 Nov 2025 14:55:59 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=itb.spb.ru; s=mail; t=1763726159; bh=72tZMXMbrGt2bxxBvi56/JVoucyj7GYZJLxapjYCMeo=; h=Message-Id:Date:Cc:Subject:To:From; b=VchB+89NOixxgNbVYuL3ui9ZJ0HlUfxZgyofm27R3EYy/E7fAzvq6bvRnEM0AI+Ju 4tEY8WYBrUY8tkV8cZ4O14YCWrNpyKtninEgzKnFDZ28pswM4zJ4hwuoHOrXxJK7t8 hy68Odfb6mYIzU3T+4zmMk1PBtH+Bn0UJdiqVdRI= Authentication-Results: mail-nwsmtp-smtp-production-main-74.iva.yp-c.yandex.net; dkim=pass header.i=@itb.spb.ru From: Ivan Stepchenko To: Miquel Raynal Cc: Ivan Stepchenko , Richard Weinberger , Vignesh Raghavendra , David Woodhouse , Jared Hulbert , Alexey Korolev , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.com Subject: [PATCH] mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Date: Fri, 21 Nov 2025 14:54:46 +0300 Message-Id: <20251121115446.11421-1-sid@itb.spb.ru> X-Mailer: git-send-email 2.39.5 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" There are several places where a value of type 'int' is shifted by lpddr->chipshift. lpddr->chipshift is derived from QINFO geometry and might reach 31 when QINFO reports a 2 GiB size - the maximum supported by LPDDR(1) compliant chips. This may cause unexpected sign-extensions when casting the integer value to the type of 'unsigned long'. Use '1UL << lpddr->chipshift' and cast 'j' to unsigned long before shifting so the computation is performed at the destination width. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c68264711ca6 ("[MTD] LPDDR Command set driver") Signed-off-by: Ivan Stepchenko --- drivers/mtd/lpddr/lpddr_cmds.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c index 14e36ae71958..bd76479b90e4 100644 --- a/drivers/mtd/lpddr/lpddr_cmds.c +++ b/drivers/mtd/lpddr/lpddr_cmds.c @@ -79,7 +79,7 @@ struct mtd_info *lpddr_cmdset(struct map_info *map) mutex_init(&shared[i].lock); for (j =3D 0; j < lpddr->qinfo->HWPartsNum; j++) { *chip =3D lpddr->chips[i]; - chip->start +=3D j << lpddr->chipshift; + chip->start +=3D (unsigned long)j << lpddr->chipshift; chip->oldstate =3D chip->state =3D FL_READY; chip->priv =3D &shared[i]; /* those should be reset too since @@ -559,7 +559,7 @@ static int lpddr_point(struct mtd_info *mtd, loff_t adr= , size_t len, break; =20 if ((len + ofs - 1) >> lpddr->chipshift) - thislen =3D (1<chipshift) - ofs; + thislen =3D (1UL << lpddr->chipshift) - ofs; else thislen =3D len; /* get the chip */ @@ -575,7 +575,7 @@ static int lpddr_point(struct mtd_info *mtd, loff_t adr= , size_t len, len -=3D thislen; =20 ofs =3D 0; - last_end +=3D 1 << lpddr->chipshift; + last_end +=3D 1UL << lpddr->chipshift; chipnum++; chip =3D &lpddr->chips[chipnum]; } @@ -601,7 +601,7 @@ static int lpddr_unpoint (struct mtd_info *mtd, loff_t = adr, size_t len) break; =20 if ((len + ofs - 1) >> lpddr->chipshift) - thislen =3D (1<chipshift) - ofs; + thislen =3D (1UL << lpddr->chipshift) - ofs; else thislen =3D len; =20 --=20 2.39.5