summaryrefslogtreecommitdiff
path: root/src/northbridge
diff options
context:
space:
mode:
authorJacob Garber <jgarber1@ualberta.ca>2019-04-11 21:08:04 -0600
committerPatrick Georgi <pgeorgi@google.com>2019-08-20 18:22:09 +0000
commitf5238b243fbb8314b8e5d26e7c8279b8e9d28c94 (patch)
tree85a560f987d3bb7d1e39e5e9a64043affe84e716 /src/northbridge
parent64d8b9decf8fe51e13ef5e5e89c71682f1696608 (diff)
downloadcoreboot-f5238b243fbb8314b8e5d26e7c8279b8e9d28c94.tar.xz
nb/via/vx900: Ensure memory size and base are in range
We need to ensure uma_memory_size and uma_memory_base stay within a 32-bit address range. Both of these variables are 64 bits wide, so it is simplest to use 64 bit math when doing the bit shifts and then check if they are in range after. Change-Id: Idd180f31e8cff797a6499b12bc685daa993aae05 Signed-off-by: Jacob Garber <jgarber1@ualberta.ca> Found-by: Coverity CID 1229665, 1229666 Reviewed-on: https://review.coreboot.org/c/coreboot/+/32291 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Diffstat (limited to 'src/northbridge')
-rw-r--r--src/northbridge/via/vx900/northbridge.c11
1 files changed, 9 insertions, 2 deletions
diff --git a/src/northbridge/via/vx900/northbridge.c b/src/northbridge/via/vx900/northbridge.c
index d865f388cd..260bd3de05 100644
--- a/src/northbridge/via/vx900/northbridge.c
+++ b/src/northbridge/via/vx900/northbridge.c
@@ -266,8 +266,15 @@ static void vx900_set_resources(struct device *dev)
* to be always mapped to the top of 1M, but this can be overcome with
* some smart positive/subtractive resource decoding */
ram_resource(dev, idx++, 768, (tolmk - 768));
- uma_memory_size = fbufk << 10;
- uma_memory_base = tolmk << 10;
+
+ uma_memory_size = (uint64_t)fbufk << 10;
+ uma_memory_base = (uint64_t)tolmk << 10;
+
+ if (uma_memory_size > UINT32_MAX)
+ die("uma_memory_size %llu exceeds 32-bit address range\n", uma_memory_size);
+
+ if (uma_memory_base > UINT32_MAX)
+ die("uma_memory_base %llu exceeds 32-bit address range\n", uma_memory_base);
//uma_resource(dev, idx++, uma_memory_base>>10, uma_memory_size>>10);