From 8731293170dc49f8c2ca0c8534828a025576242f Mon Sep 17 00:00:00 2001 From: Pierre-Eric Pelloux-Prayer Date: Thu, 19 Jun 2025 10:17:15 +0200 Subject: [PATCH] radeonsi: fix potential overflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by static analysis. Multiplication may overflow before being converted to the larger type, so fix this by casting one of the operands to the destination type. Reviewed-by: Marek Olšák Part-of: --- src/gallium/drivers/radeonsi/si_compute.c | 2 +- src/gallium/drivers/radeonsi/si_debug.c | 2 +- src/gallium/drivers/radeonsi/si_state_draw.cpp | 8 ++++---- src/gallium/drivers/radeonsi/si_test_blit_perf.c | 2 +- src/gallium/drivers/radeonsi/si_texture.c | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/gallium/drivers/radeonsi/si_compute.c b/src/gallium/drivers/radeonsi/si_compute.c index 6c2f9a70a47..35b683dd098 100644 --- a/src/gallium/drivers/radeonsi/si_compute.c +++ b/src/gallium/drivers/radeonsi/si_compute.c @@ -294,7 +294,7 @@ static bool si_setup_compute_scratch_buffer(struct si_context *sctx, struct si_s { uint64_t scratch_bo_size = sctx->compute_scratch_buffer ? sctx->compute_scratch_buffer->b.b.width0 : 0; - uint64_t scratch_needed = sctx->max_seen_compute_scratch_bytes_per_wave * + uint64_t scratch_needed = (uint64_t)sctx->max_seen_compute_scratch_bytes_per_wave * sctx->screen->info.max_scratch_waves; assert(scratch_needed); diff --git a/src/gallium/drivers/radeonsi/si_debug.c b/src/gallium/drivers/radeonsi/si_debug.c index 30a164479b0..640c2ccc8f9 100644 --- a/src/gallium/drivers/radeonsi/si_debug.c +++ b/src/gallium/drivers/radeonsi/si_debug.c @@ -739,7 +739,7 @@ static void si_dump_descriptor_list(struct si_screen *screen, struct si_descript } struct si_log_chunk_desc_list *chunk = - CALLOC_VARIANT_LENGTH_STRUCT(si_log_chunk_desc_list, 4 * element_dw_size * num_elements); + CALLOC_VARIANT_LENGTH_STRUCT(si_log_chunk_desc_list, 4 * (size_t)element_dw_size * num_elements); chunk->shader_name = shader_name; chunk->elem_name = elem_name; chunk->element_dw_size = element_dw_size; diff --git a/src/gallium/drivers/radeonsi/si_state_draw.cpp b/src/gallium/drivers/radeonsi/si_state_draw.cpp index 305cd22a11c..07b0171cb95 100644 --- a/src/gallium/drivers/radeonsi/si_state_draw.cpp +++ b/src/gallium/drivers/radeonsi/si_state_draw.cpp @@ -1586,7 +1586,7 @@ static void si_emit_draw_packets(struct si_context *sctx, const struct pipe_draw if (increment_draw_id) { if (index_bias_varies) { for (unsigned i = 0; i < num_draws; i++) { - uint64_t va = index_va + draws[i].start * index_size; + uint64_t va = index_va + (uint64_t)draws[i].start * index_size; if (i > 0) { radeon_set_sh_reg_seq(sh_base_reg + SI_SGPR_BASE_VERTEX * 4, 2); @@ -1610,7 +1610,7 @@ static void si_emit_draw_packets(struct si_context *sctx, const struct pipe_draw } else { /* Only DrawID varies. */ for (unsigned i = 0; i < num_draws; i++) { - uint64_t va = index_va + draws[i].start * index_size; + uint64_t va = index_va + (uint64_t)draws[i].start * index_size; if (i > 0) radeon_set_sh_reg(sh_base_reg + SI_SGPR_DRAWID * 4, drawid_base + i); @@ -1632,7 +1632,7 @@ static void si_emit_draw_packets(struct si_context *sctx, const struct pipe_draw if (index_bias_varies) { /* Only BaseVertex varies. */ for (unsigned i = 0; i < num_draws; i++) { - uint64_t va = index_va + draws[i].start * index_size; + uint64_t va = index_va + (uint64_t)draws[i].start * index_size; if (i > 0) radeon_set_sh_reg(sh_base_reg + SI_SGPR_BASE_VERTEX * 4, draws[i].index_bias); @@ -1662,7 +1662,7 @@ static void si_emit_draw_packets(struct si_context *sctx, const struct pipe_draw } for (unsigned i = 0; i < num_draws; i++) { - uint64_t va = index_va + draws[i].start * index_size; + uint64_t va = index_va + (uint64_t)draws[i].start * index_size; radeon_emit(PKT3(PKT3_DRAW_INDEX_2, 4, render_cond_bit)); radeon_emit(index_max_size); diff --git a/src/gallium/drivers/radeonsi/si_test_blit_perf.c b/src/gallium/drivers/radeonsi/si_test_blit_perf.c index 7a523a020d7..f9391412c1c 100644 --- a/src/gallium/drivers/radeonsi/si_test_blit_perf.c +++ b/src/gallium/drivers/radeonsi/si_test_blit_perf.c @@ -670,7 +670,7 @@ void si_test_blit_perf(struct si_screen *sscreen) ctx->destroy_query(ctx, q); double sec = (double)result.u64 / (1000 * 1000 * 1000); - uint64_t pixels_per_surf = num_repeats * dst_box.width * + uint64_t pixels_per_surf = num_repeats * (uint64_t) dst_box.width * dst_box.height * dst_box.depth; uint64_t bytes; diff --git a/src/gallium/drivers/radeonsi/si_texture.c b/src/gallium/drivers/radeonsi/si_texture.c index 48877bc5a0b..b8abc3975a8 100644 --- a/src/gallium/drivers/radeonsi/si_texture.c +++ b/src/gallium/drivers/radeonsi/si_texture.c @@ -1545,7 +1545,7 @@ bool si_texture_commit(struct si_context *ctx, struct si_resource *res, unsigned for (int i = 0; i < d; i++) { uint64_t base = commit_base + i * depth_pitch; for (int j = 0; j < h; j++) { - uint64_t offset = base + j * row_pitch; + uint64_t offset = base + j * (uint64_t)row_pitch; if (!ctx->ws->buffer_commit(ctx->ws, res->buf, offset, size, commit)) return false; }