diff options
| author | zhoumin <teczm@foxmail.com> | 2026-03-26 17:14:03 +0800 |
|---|---|---|
| committer | Tony Luck <tony.luck@intel.com> | 2026-05-29 08:34:12 -0700 |
| commit | c63ed6e1f5fe648a4a099b6717f679999be482ef (patch) | |
| tree | 2457d6ee95c6a03110d46aa578671514a34673c7 | |
| parent | d9b75e35503959a81ab175a40b9690b7c9da34a0 (diff) | |
EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
When the skx_get_dimm_attr() helper returns -EINVAL,
skx_get_dimm_info() does not validate these return values before using
them in a shift operation:
size = ((1ull << (rows + cols + ranks)) * banks) >> (20 - 3);
If all three values are -22, the shift exponent becomes -66, triggering
a UBSAN shift-out-of-bounds error:
UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c
shift exponent -66 is negative
Fixes: 88a242c98740 ("EDAC, skx_common: Separate common code out from skx_edac")
Signed-off-by: zhoumin <teczm@foxmail.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Link: https://patch.msgid.link/tencent_2A0CC835A18366643CBD2865B169948AB409@qq.com
| -rw-r--r-- | drivers/edac/skx_common.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c index a9557c8344bc..f15de0ea96c8 100644 --- a/drivers/edac/skx_common.c +++ b/drivers/edac/skx_common.c @@ -466,6 +466,9 @@ int skx_get_dimm_info(u32 mtr, u32 mcmtr, u32 amap, struct dimm_info *dimm, rows = numrow(mtr); cols = imc->hbm_mc ? 6 : numcol(mtr); + if (ranks < 0 || rows < 0 || cols < 0) + return 0; + if (imc->hbm_mc) { banks = 32; mtype = MEM_HBM2; |