diff mbox series

[v2,3/3] arm: caches: manage phys_addr_t overflow in mmu_set_region_dcache_behaviour

Message ID 20200424201957.v2.3.Ic2c7c6923035711a4c653d52ae7c0f57ca6f9210@changeid
State Accepted
Commit 54be09cd8f6e66f59144f9e5861b0252ed441d89
Headers show
Series arm: caches: allow to activate dcache in SPL and in U-Boot pre-reloc | expand

Commit Message

Patrick Delaunay April 24, 2020, 6:20 p.m. UTC
Solved the overflow on phys_addr_t type for start + size in
mmu_set_region_dcache_behaviour() function.

This overflow is avoided by dividing start and end by 2 before addition,
and we only expecting that start and size are even.

This patch doesn't change the current function behavior if the
parameters (start or size) are not aligned on MMU_SECTION_SIZE.

For example, this overflow occurs on ARM32 with:
start = 0xC0000000 and size = 0x40000000
then start + size = 0x100000000 and end = 0x0.

For information the function behavior change with risk of regression,
if we just shift start and size before the addition.
Example with 2MB section size:
  MMU_SECTION_SIZE 0x200000 and MMU_SECTION_SHIFT = 21
  with start = 0x1000000, size = 0x1000000,
  - with the proposed patch, start = 0 and end = 0x1 as previously
  - with the more simple patch:
    end = (start >> MMU_SECTION_SHIFT) + (size >> MMU_SECTION_SHIFT)
    the value of end change:
    start >> 21 = 0, size >> 21 = 0 and end = 0x0 !!!

Signed-off-by: Patrick Delaunay <patrick.delaunay at st.com>
---

Changes in v2:
- update patch after Marek's proposal. but I just divided by 2 instead
  of 4kB (minimal MMU page size)

 arch/arm/lib/cache-cp15.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Tom Rini May 1, 2020, 9:56 p.m. UTC | #1
On Fri, Apr 24, 2020 at 08:20:17PM +0200, Patrick Delaunay wrote:

> Solved the overflow on phys_addr_t type for start + size in
> mmu_set_region_dcache_behaviour() function.
> 
> This overflow is avoided by dividing start and end by 2 before addition,
> and we only expecting that start and size are even.
> 
> This patch doesn't change the current function behavior if the
> parameters (start or size) are not aligned on MMU_SECTION_SIZE.
> 
> For example, this overflow occurs on ARM32 with:
> start = 0xC0000000 and size = 0x40000000
> then start + size = 0x100000000 and end = 0x0.
> 
> For information the function behavior change with risk of regression,
> if we just shift start and size before the addition.
> Example with 2MB section size:
>   MMU_SECTION_SIZE 0x200000 and MMU_SECTION_SHIFT = 21
>   with start = 0x1000000, size = 0x1000000,
>   - with the proposed patch, start = 0 and end = 0x1 as previously
>   - with the more simple patch:
>     end = (start >> MMU_SECTION_SHIFT) + (size >> MMU_SECTION_SHIFT)
>     the value of end change:
>     start >> 21 = 0, size >> 21 = 0 and end = 0x0 !!!
> 
> Signed-off-by: Patrick Delaunay <patrick.delaunay at st.com>

Applied to u-boot/master, thanks!
diff mbox series

Patch

diff --git a/arch/arm/lib/cache-cp15.c b/arch/arm/lib/cache-cp15.c
index d15144188b..f803d6fb8c 100644
--- a/arch/arm/lib/cache-cp15.c
+++ b/arch/arm/lib/cache-cp15.c
@@ -61,8 +61,11 @@  void mmu_set_region_dcache_behaviour(phys_addr_t start, size_t size,
 	unsigned long startpt, stoppt;
 	unsigned long upto, end;
 
-	end = ALIGN(start + size, MMU_SECTION_SIZE) >> MMU_SECTION_SHIFT;
+	/* div by 2 before start + size to avoid phys_addr_t overflow */
+	end = ALIGN((start / 2) + (size / 2), MMU_SECTION_SIZE / 2)
+	      >> (MMU_SECTION_SHIFT - 1);
 	start = start >> MMU_SECTION_SHIFT;
+
 #ifdef CONFIG_ARMV7_LPAE
 	debug("%s: start=%pa, size=%zu, option=%llx\n", __func__, &start, size,
 	      option);