From: zhoumin Date: Thu, 26 Mar 2026 09:14:03 +0000 (+0800) Subject: EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=c63ed6e1f5fe648a4a099b6717f679999be482ef;p=thirdparty%2Fkernel%2Flinux.git EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info When the skx_get_dimm_attr() helper returns -EINVAL, skx_get_dimm_info() does not validate these return values before using them in a shift operation: size = ((1ull << (rows + cols + ranks)) * banks) >> (20 - 3); If all three values are -22, the shift exponent becomes -66, triggering a UBSAN shift-out-of-bounds error: UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c shift exponent -66 is negative Fixes: 88a242c98740 ("EDAC, skx_common: Separate common code out from skx_edac") Signed-off-by: zhoumin Signed-off-by: Tony Luck Link: https://patch.msgid.link/tencent_2A0CC835A18366643CBD2865B169948AB409@qq.com --- diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c index a9557c8344bc1..f15de0ea96c87 100644 --- a/drivers/edac/skx_common.c +++ b/drivers/edac/skx_common.c @@ -466,6 +466,9 @@ int skx_get_dimm_info(u32 mtr, u32 mcmtr, u32 amap, struct dimm_info *dimm, rows = numrow(mtr); cols = imc->hbm_mc ? 6 : numcol(mtr); + if (ranks < 0 || rows < 0 || cols < 0) + return 0; + if (imc->hbm_mc) { banks = 32; mtype = MEM_HBM2;