diff options
| author | Jacob Garber <jgarber1@ualberta.ca> | 2019-04-11 21:08:04 -0600 |
|---|---|---|
| committer | Patrick Georgi <pgeorgi@google.com> | 2019-08-20 18:22:09 +0000 |
| commit | f5238b243fbb8314b8e5d26e7c8279b8e9d28c94 (patch) | |
| tree | 85a560f987d3bb7d1e39e5e9a64043affe84e716 /src/northbridge/via | |
| parent | 64d8b9decf8fe51e13ef5e5e89c71682f1696608 (diff) | |
nb/via/vx900: Ensure memory size and base are in range
We need to ensure uma_memory_size and uma_memory_base stay within a
32-bit address range. Both of these variables are 64 bits wide, so it is
simplest to use 64 bit math when doing the bit shifts and then check if
they are in range after.
Change-Id: Idd180f31e8cff797a6499b12bc685daa993aae05
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Found-by: Coverity CID 1229665, 1229666
Reviewed-on: https://review.coreboot.org/c/coreboot/+/32291
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Diffstat (limited to 'src/northbridge/via')
| -rw-r--r-- | src/northbridge/via/vx900/northbridge.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/src/northbridge/via/vx900/northbridge.c b/src/northbridge/via/vx900/northbridge.c index d865f388cd..260bd3de05 100644 --- a/src/northbridge/via/vx900/northbridge.c +++ b/src/northbridge/via/vx900/northbridge.c @@ -266,8 +266,15 @@ static void vx900_set_resources(struct device *dev) * to be always mapped to the top of 1M, but this can be overcome with * some smart positive/subtractive resource decoding */ ram_resource(dev, idx++, 768, (tolmk - 768)); - uma_memory_size = fbufk << 10; - uma_memory_base = tolmk << 10; + + uma_memory_size = (uint64_t)fbufk << 10; + uma_memory_base = (uint64_t)tolmk << 10; + + if (uma_memory_size > UINT32_MAX) + die("uma_memory_size %llu exceeds 32-bit address range\n", uma_memory_size); + + if (uma_memory_base > UINT32_MAX) + die("uma_memory_base %llu exceeds 32-bit address range\n", uma_memory_base); //uma_resource(dev, idx++, uma_memory_base>>10, uma_memory_size>>10); |