[src/trunk]: src/sys/external/bsd/drm2/dist/drm/via drm: Avoid potential inte...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/8457c9096286
branches:  trunk
changeset: 1028925:8457c9096286
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sun Dec 19 12:29:47 2021 +0000

description:
drm: Avoid potential integer overflow in pages->bytes conversion.

diffstat:

 sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c |  13 +++--
 sys/external/bsd/drm2/dist/drm/via/via_dmablit.c                                               |  22 +++++----
 2 files changed, 20 insertions(+), 15 deletions(-)

diffs (125 lines):

diff -r 9ef0de21498e -r 8457c9096286 sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c
--- a/sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c    Sun Dec 19 12:29:39 2021 +0000
+++ b/sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c    Sun Dec 19 12:29:47 2021 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nouveau_nvkm_subdev_instmem_gk20a.c,v 1.8 2021/12/19 11:34:45 riastradh Exp $  */
+/*     $NetBSD: nouveau_nvkm_subdev_instmem_gk20a.c,v 1.9 2021/12/19 12:29:47 riastradh Exp $  */
 
 /*
  * Copyright (c) 2015, NVIDIA CORPORATION. All rights reserved.
@@ -44,7 +44,7 @@
  * goes beyond a certain threshold. At the moment this limit is 1MB.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nouveau_nvkm_subdev_instmem_gk20a.c,v 1.8 2021/12/19 11:34:45 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nouveau_nvkm_subdev_instmem_gk20a.c,v 1.9 2021/12/19 12:29:47 riastradh Exp $");
 
 #include "priv.h"
 
@@ -507,24 +507,25 @@
        node->base.memory.ptrs = &gk20a_instobj_ptrs;
 
 #ifdef __NetBSD__
+       bus_size_t nbytes = (bus_size_t)npages << PAGE_SHIFT;
        __USE(i);
        __USE(r);
        __USE(dev);
        /* XXX errno NetBSD->Linux */
-       ret = -bus_dmamem_alloc(imem->dmat, npages << PAGE_SHIFT, PAGE_SIZE,
+       ret = -bus_dmamem_alloc(imem->dmat, nbytes, PAGE_SIZE,
            PAGE_SIZE, node->segs, npages, &node->nsegs, BUS_DMA_WAITOK);
        if (ret)
 fail0:         goto out;
        /* XXX errno NetBSD->Linux */
-       ret = -bus_dmamap_create(imem->dmat, npages << PAGE_SHIFT, 1,
-           npages << PAGE_SHIFT, PAGE_SIZE, BUS_DMA_WAITOK, &node->map);
+       ret = -bus_dmamap_create(imem->dmat, nbytes, 1, nbytes, PAGE_SIZE,
+           BUS_DMA_WAITOK, &node->map);
        if (ret) {
 fail1:         bus_dmamem_free(imem->dmat, node->segs, node->nsegs);
                goto fail0;
        }
        /* XXX errno NetBSD->Linux */
        ret = -bus_dmamap_load_raw(imem->dmat, node->map, node->segs,
-           node->nsegs, npages << PAGE_SHIFT, BUS_DMA_WAITOK);
+           node->nsegs, nbytes, BUS_DMA_WAITOK);
        if (ret) {
 fail2: __unused
                bus_dmamap_destroy(imem->dmat, node->map);
diff -r 9ef0de21498e -r 8457c9096286 sys/external/bsd/drm2/dist/drm/via/via_dmablit.c
--- a/sys/external/bsd/drm2/dist/drm/via/via_dmablit.c  Sun Dec 19 12:29:39 2021 +0000
+++ b/sys/external/bsd/drm2/dist/drm/via/via_dmablit.c  Sun Dec 19 12:29:47 2021 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: via_dmablit.c,v 1.9 2021/12/18 23:45:44 riastradh Exp $        */
+/*     $NetBSD: via_dmablit.c,v 1.10 2021/12/19 12:29:47 riastradh Exp $       */
 
 /* via_dmablit.c -- PCI DMA BitBlt support for the VIA Unichrome/Pro
  *
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: via_dmablit.c,v 1.9 2021/12/18 23:45:44 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: via_dmablit.c,v 1.10 2021/12/19 12:29:47 riastradh Exp $");
 
 #include <linux/pagemap.h>
 #include <linux/pci.h>
@@ -212,7 +212,7 @@
                bus_dmamap_unload(dev->dmat, vsg->desc_dmamap);
                bus_dmamap_destroy(dev->dmat, vsg->desc_dmamap);
                bus_dmamem_unmap(dev->dmat, vsg->desc_kva,
-                   vsg->num_desc_pages << PAGE_SHIFT);
+                   (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT);
                bus_dmamem_free(dev->dmat, vsg->desc_segs, vsg->num_desc_segs);
                kfree(vsg->desc_segs);
 #else
@@ -360,7 +360,8 @@
                return -ENOMEM;
        }
        /* XXX errno NetBSD->Linux */
-       ret = -bus_dmamem_alloc(dev->dmat, vsg->num_desc_pages << PAGE_SHIFT,
+       ret = -bus_dmamem_alloc(dev->dmat,
+           (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT,
            PAGE_SIZE, 0, vsg->desc_segs, vsg->num_pages, &vsg->num_desc_segs,
            BUS_DMA_WAITOK);
        if (ret) {
@@ -371,7 +372,8 @@
        /* XXX No nice way to scatter/gather map bus_dmamem.  */
        /* XXX errno NetBSD->Linux */
        ret = -bus_dmamem_map(dev->dmat, vsg->desc_segs, vsg->num_desc_segs,
-           vsg->num_desc_pages << PAGE_SHIFT, &vsg->desc_kva, BUS_DMA_WAITOK);
+           (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT, &vsg->desc_kva,
+           BUS_DMA_WAITOK);
        if (ret) {
                bus_dmamem_free(dev->dmat, vsg->desc_segs, vsg->num_desc_segs);
                kfree(vsg->desc_segs);
@@ -379,23 +381,25 @@
                return -ENOMEM;
        }
        /* XXX errno NetBSD->Linux */
-       ret = -bus_dmamap_create(dev->dmat, vsg->num_desc_pages << PAGE_SHIFT,
+       ret = -bus_dmamap_create(dev->dmat,
+           (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT,
            vsg->num_desc_pages, PAGE_SIZE, 0, BUS_DMA_WAITOK,
            &vsg->desc_dmamap);
        if (ret) {
                bus_dmamem_unmap(dev->dmat, vsg->desc_kva,
-                   vsg->num_desc_pages << PAGE_SHIFT);
+                   (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT);
                bus_dmamem_free(dev->dmat, vsg->desc_segs, vsg->num_desc_segs);
                kfree(vsg->desc_segs);
                kfree(vsg->desc_pages);
                return -ENOMEM;
        }
        ret = -bus_dmamap_load(dev->dmat, vsg->desc_dmamap, vsg->desc_kva,
-           vsg->num_desc_pages << PAGE_SHIFT, NULL, BUS_DMA_WAITOK);
+           (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT, NULL,
+           BUS_DMA_WAITOK);
        if (ret) {
                bus_dmamap_destroy(dev->dmat, vsg->desc_dmamap);
                bus_dmamem_unmap(dev->dmat, vsg->desc_kva,
-                   vsg->num_desc_pages << PAGE_SHIFT);
+                   (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT);
                bus_dmamem_free(dev->dmat, vsg->desc_segs, vsg->num_desc_segs);
                kfree(vsg->desc_segs);
                kfree(vsg->desc_pages);