From f5238b243fbb8314b8e5d26e7c8279b8e9d28c94 Mon Sep 17 00:00:00 2001 From: Jacob Garber Date: Thu, 11 Apr 2019 21:08:04 -0600 Subject: nb/via/vx900: Ensure memory size and base are in range We need to ensure uma_memory_size and uma_memory_base stay within a 32-bit address range. Both of these variables are 64 bits wide, so it is simplest to use 64 bit math when doing the bit shifts and then check if they are in range after. Change-Id: Idd180f31e8cff797a6499b12bc685daa993aae05 Signed-off-by: Jacob Garber Found-by: Coverity CID 1229665, 1229666 Reviewed-on: https://review.coreboot.org/c/coreboot/+/32291 Tested-by: build bot (Jenkins) Reviewed-by: Patrick Georgi --- src/northbridge/via/vx900/northbridge.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/northbridge/via/vx900/northbridge.c b/src/northbridge/via/vx900/northbridge.c index d865f388cd..260bd3de05 100644 --- a/src/northbridge/via/vx900/northbridge.c +++ b/src/northbridge/via/vx900/northbridge.c @@ -266,8 +266,15 @@ static void vx900_set_resources(struct device *dev) * to be always mapped to the top of 1M, but this can be overcome with * some smart positive/subtractive resource decoding */ ram_resource(dev, idx++, 768, (tolmk - 768)); - uma_memory_size = fbufk << 10; - uma_memory_base = tolmk << 10; + + uma_memory_size = (uint64_t)fbufk << 10; + uma_memory_base = (uint64_t)tolmk << 10; + + if (uma_memory_size > UINT32_MAX) + die("uma_memory_size %llu exceeds 32-bit address range\n", uma_memory_size); + + if (uma_memory_base > UINT32_MAX) + die("uma_memory_base %llu exceeds 32-bit address range\n", uma_memory_base); //uma_resource(dev, idx++, uma_memory_base>>10, uma_memory_size>>10); -- cgit v1.2.3