Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

misc: amd-sbi: Address potential integer overflow issue reported in smatch

Smatch warnings are reported for below commit,

Commit bb13a84ed6b7 ("misc: amd-sbi: Add support for CPUID protocol")
from Apr 28, 2025 (linux-next), leads to the following Smatch static
checker warning:

drivers/misc/amd-sbi/rmi-core.c:132 rmi_cpuid_read() warn: bitwise OR is zero '0xffffffff00000000 & 0xffff'
drivers/misc/amd-sbi/rmi-core.c:132 rmi_cpuid_read() warn: potential integer overflow from user 'msg->cpu_in_out << 32'
drivers/misc/amd-sbi/rmi-core.c:213 rmi_mca_msr_read() warn: bitwise OR is zero '0xffffffff00000000 & 0xffff'
drivers/misc/amd-sbi/rmi-core.c:213 rmi_mca_msr_read() warn: potential integer overflow from user 'msg->mcamsr_in_out << 32'

CPUID & MCAMSR thread data from input is available at byte 4 & 5, this
patch fixes to copy the user data correctly in the argument.
Previously, CPUID and MCAMSR data is return only for thread 0.

Fixes: bb13a84ed6b7 ("misc: amd-sbi: Add support for CPUID protocol")
Fixes: 69b1ba83d21c ("misc: amd-sbi: Add support for read MCA register protocol")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aDVyO8ByVsceybk9@stanley.mountain/
Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com>
Signed-off-by: Akshay Gupta <akshay.gupta@amd.com>
Link: https://lore.kernel.org/r/20250716110729.2193725-1-akshay.gupta@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Akshay Gupta and committed by
Greg Kroah-Hartman
e108b0a5 1b98304c

+2 -3
+2 -3
drivers/misc/amd-sbi/rmi-core.c
··· 42 42 #define RD_MCA_CMD 0x86 43 43 44 44 /* CPUID MCAMSR mask & index */ 45 - #define CPUID_MCA_THRD_MASK GENMASK(15, 0) 46 45 #define CPUID_MCA_THRD_INDEX 32 47 46 #define CPUID_MCA_FUNC_MASK GENMASK(31, 0) 48 47 #define CPUID_EXT_FUNC_INDEX 56 ··· 128 129 goto exit_unlock; 129 130 } 130 131 131 - thread = msg->cpu_in_out << CPUID_MCA_THRD_INDEX & CPUID_MCA_THRD_MASK; 132 + thread = msg->cpu_in_out >> CPUID_MCA_THRD_INDEX; 132 133 133 134 /* Thread > 127, Thread128 CS register, 1'b1 needs to be set to 1 */ 134 135 if (thread > 127) { ··· 209 210 goto exit_unlock; 210 211 } 211 212 212 - thread = msg->mcamsr_in_out << CPUID_MCA_THRD_INDEX & CPUID_MCA_THRD_MASK; 213 + thread = msg->mcamsr_in_out >> CPUID_MCA_THRD_INDEX; 213 214 214 215 /* Thread > 127, Thread128 CS register, 1'b1 needs to be set to 1 */ 215 216 if (thread > 127) {