drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets

From Nikita Zhandarovich
fa94d60546d2ba8c55f3c87483404162f1fbe863 in linux-6.6.y/6.6.54
3fbaf475a5b8361ebee7da18964db809e37518b7 in mainline linux

diff --git a/sys/dev/pci/drm/radeon/evergreen_cs.c b/sys/dev/pci/drm/radeon/evergreen_cs.c
index 0de79f3..820c2c3 100644 (file)
--- a/sys/dev/pci/drm/radeon/evergreen_cs.c
+++ b/sys/dev/pci/drm/radeon/evergreen_cs.c
@@ -395,7 +395,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
        struct evergreen_cs_track *track = p->track;
        struct eg_surface surf;
        unsigned pitch, slice, mslice;
-       unsigned long offset;
+       u64 offset;
        int r;
 
        mslice = G_028C6C_SLICE_MAX(track->cb_color_view[id]) + 1;
@@ -433,14 +433,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
                return r;
        }
 
-       offset = track->cb_color_bo_offset[id] << 8;
+       offset = (u64)track->cb_color_bo_offset[id] << 8;
        if (offset & (surf.base_align - 1)) {
-               dev_warn(p->dev, "%s:%d cb[%d] bo base %ld not aligned with %ld\n",
+               dev_warn(p->dev, "%s:%d cb[%d] bo base %llu not aligned with %ld\n",
                         __func__, __LINE__, id, offset, surf.base_align);
                return -EINVAL;
        }
 
-       offset += surf.layer_size * mslice;
+       offset += (u64)surf.layer_size * mslice;
        if (offset > radeon_bo_size(track->cb_color_bo[id])) {
                /* old ddx are broken they allocate bo with w*h*bpp but
                 * program slice with ALIGN(h, 8), catch this and patch
@@ -448,14 +448,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
                 */
                if (!surf.mode) {
                        uint32_t *ib = p->ib.ptr;
-                       unsigned long tmp, nby, bsize, size, min = 0;
+                       u64 tmp, nby, bsize, size, min = 0;
 
                        /* find the height the ddx wants */
                        if (surf.nby > 8) {
                                min = surf.nby - 8;
                        }
                        bsize = radeon_bo_size(track->cb_color_bo[id]);
-                       tmp = track->cb_color_bo_offset[id] << 8;
+                       tmp = (u64)track->cb_color_bo_offset[id] << 8;
                        for (nby = surf.nby; nby > min; nby--) {
                                size = nby * surf.nbx * surf.bpe * surf.nsamples;
                                if ((tmp + size * mslice) <= bsize) {
@@ -467,7 +467,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
                                slice = ((nby * surf.nbx) / 64) - 1;
                                if (!evergreen_surface_check(p, &surf, "cb")) {
                                        /* check if this one works */
-                                       tmp += surf.layer_size * mslice;
+                                       tmp += (u64)surf.layer_size * mslice;
                                        if (tmp <= bsize) {
                                                ib[track->cb_color_slice_idx[id]] = slice;
                                                goto old_ddx_ok;
@@ -476,9 +476,9 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
                        }
                }
                dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
-                        "offset %d, max layer %d, bo size %ld, slice %d)\n",
+                        "offset %llu, max layer %d, bo size %ld, slice %d)\n",
                         __func__, __LINE__, id, surf.layer_size,
-                       track->cb_color_bo_offset[id] << 8, mslice,
+                       (u64)track->cb_color_bo_offset[id] << 8, mslice,
                        radeon_bo_size(track->cb_color_bo[id]), slice);
                dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n",
                         __func__, __LINE__, surf.nbx, surf.nby,
@@ -562,7 +562,7 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
        struct evergreen_cs_track *track = p->track;
        struct eg_surface surf;
        unsigned pitch, slice, mslice;
-       unsigned long offset;
+       u64 offset;
        int r;
 
        mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
@@ -608,18 +608,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
                return r;
        }
 
-       offset = track->db_s_read_offset << 8;
+       offset = (u64)track->db_s_read_offset << 8;
        if (offset & (surf.base_align - 1)) {
-               dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
+               dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
                         __func__, __LINE__, offset, surf.base_align);
                return -EINVAL;
        }
-       offset += surf.layer_size * mslice;
+       offset += (u64)surf.layer_size * mslice;
        if (offset > radeon_bo_size(track->db_s_read_bo)) {
                dev_warn(p->dev, "%s:%d stencil read bo too small (layer size %d, "
-                        "offset %ld, max layer %d, bo size %ld)\n",
+                        "offset %llu, max layer %d, bo size %ld)\n",
                         __func__, __LINE__, surf.layer_size,
-                       (unsigned long)track->db_s_read_offset << 8, mslice,
+                       (u64)track->db_s_read_offset << 8, mslice,
                        radeon_bo_size(track->db_s_read_bo));
                dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
                         __func__, __LINE__, track->db_depth_size,
@@ -627,18 +627,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
                return -EINVAL;
        }
 
-       offset = track->db_s_write_offset << 8;
+       offset = (u64)track->db_s_write_offset << 8;
        if (offset & (surf.base_align - 1)) {
-               dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
+               dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
                         __func__, __LINE__, offset, surf.base_align);
                return -EINVAL;
        }
-       offset += surf.layer_size * mslice;
+       offset += (u64)surf.layer_size * mslice;
        if (offset > radeon_bo_size(track->db_s_write_bo)) {
                dev_warn(p->dev, "%s:%d stencil write bo too small (layer size %d, "
-                        "offset %ld, max layer %d, bo size %ld)\n",
+                        "offset %llu, max layer %d, bo size %ld)\n",
                         __func__, __LINE__, surf.layer_size,
-                       (unsigned long)track->db_s_write_offset << 8, mslice,
+                       (u64)track->db_s_write_offset << 8, mslice,
                        radeon_bo_size(track->db_s_write_bo));
                return -EINVAL;
        }
@@ -659,7 +659,7 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
        struct evergreen_cs_track *track = p->track;
        struct eg_surface surf;
        unsigned pitch, slice, mslice;
-       unsigned long offset;
+       u64 offset;
        int r;
 
        mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
@@ -706,34 +706,34 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
                return r;
        }
 
-       offset = track->db_z_read_offset << 8;
+       offset = (u64)track->db_z_read_offset << 8;
        if (offset & (surf.base_align - 1)) {
-               dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
+               dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
                         __func__, __LINE__, offset, surf.base_align);
                return -EINVAL;
        }
-       offset += surf.layer_size * mslice;
+       offset += (u64)surf.layer_size * mslice;
        if (offset > radeon_bo_size(track->db_z_read_bo)) {
                dev_warn(p->dev, "%s:%d depth read bo too small (layer size %d, "
-                        "offset %ld, max layer %d, bo size %ld)\n",
+                        "offset %llu, max layer %d, bo size %ld)\n",
                         __func__, __LINE__, surf.layer_size,
-                       (unsigned long)track->db_z_read_offset << 8, mslice,
+                       (u64)track->db_z_read_offset << 8, mslice,
                        radeon_bo_size(track->db_z_read_bo));
                return -EINVAL;
        }
 
-       offset = track->db_z_write_offset << 8;
+       offset = (u64)track->db_z_write_offset << 8;
        if (offset & (surf.base_align - 1)) {
-               dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
+               dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
                         __func__, __LINE__, offset, surf.base_align);
                return -EINVAL;
        }
-       offset += surf.layer_size * mslice;
+       offset += (u64)surf.layer_size * mslice;
        if (offset > radeon_bo_size(track->db_z_write_bo)) {
                dev_warn(p->dev, "%s:%d depth write bo too small (layer size %d, "
-                        "offset %ld, max layer %d, bo size %ld)\n",
+                        "offset %llu, max layer %d, bo size %ld)\n",
                         __func__, __LINE__, surf.layer_size,
-                       (unsigned long)track->db_z_write_offset << 8, mslice,
+                       (u64)track->db_z_write_offset << 8, mslice,
                        radeon_bo_size(track->db_z_write_bo));
                return -EINVAL;
        }