From: jsg <jsg@openbsd.org>
Date: Thu, 19 Sep 2024 04:26:25 +0000 (+0000)
Subject: drm/i915/guc: prevent a possible int overflow in wq offsets
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=788b10814aa891a5e36982f012cc598df9e0e859;p=openbsd

drm/i915/guc: prevent a possible int overflow in wq offsets

From Nikita Zhandarovich
86238603c8f4df09b2a926617511310fd550737c in linux-6.6.y/6.6.52
d3d37f74683e2f16f2635ee265884f7ca69350ae in mainline linux
---

diff --git a/sys/dev/pci/drm/i915/gt/uc/intel_guc_submission.c b/sys/dev/pci/drm/i915/gt/uc/intel_guc_submission.c
index 2c9de9a67e8..875dfa55395 100644
--- a/sys/dev/pci/drm/i915/gt/uc/intel_guc_submission.c
+++ b/sys/dev/pci/drm/i915/gt/uc/intel_guc_submission.c
@@ -2695,9 +2695,9 @@ static void prepare_context_registration_info_v70(struct intel_context *ce,
 		ce->parallel.guc.wqi_tail = 0;
 		ce->parallel.guc.wqi_head = 0;
 
-		wq_desc_offset = i915_ggtt_offset(ce->state) +
+		wq_desc_offset = (u64)i915_ggtt_offset(ce->state) +
 				 __get_parent_scratch_offset(ce);
-		wq_base_offset = i915_ggtt_offset(ce->state) +
+		wq_base_offset = (u64)i915_ggtt_offset(ce->state) +
 				 __get_wq_offset(ce);
 		info->wq_desc_lo = lower_32_bits(wq_desc_offset);
 		info->wq_desc_hi = upper_32_bits(wq_desc_offset);