| Message ID | 20241226130311.1349-1-tsogomonian@astralinux.ru (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | hw/misc: cast rpm to uint64_t | expand |
On Thu, Dec 26, 2024 at 6:00 AM Tigran Sogomonian <tsogomonian@astralinux.ru> wrote: > The value of an arithmetic expression > 'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject > to overflow because its operands are not cast to > a larger data type before performing arithmetic. Thus, need > to cast rpm to uint64_t. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru> > Reviewed-by: Patrick Leis <venture@google.com> > --- > hw/misc/npcm7xx_mft.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c > index 9fcc69fe5c..e565cac05d 100644 > --- a/hw/misc/npcm7xx_mft.c > +++ b/hw/misc/npcm7xx_mft.c > @@ -172,8 +172,9 @@ static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt( > * RPM = revolution/min. The time for one revlution (in ns) is > * MINUTE_TO_NANOSECOND / RPM. > */ > - count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) / > - (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION)); > + count = clock_ns_to_ticks(clock, > + (uint64_t)(60 * NANOSECONDS_PER_SECOND) / > + ((uint64_t)rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION)); > } > > if (count > NPCM7XX_MFT_MAX_CNT) { > -- > 2.30.2 > > >
On Fri, Dec 27, 2024 at 3:02 AM Patrick Leis <venture@google.com> wrote: > > > On Thu, Dec 26, 2024 at 6:00 AM Tigran Sogomonian < > tsogomonian@astralinux.ru> wrote: > >> The value of an arithmetic expression >> 'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject >> to overflow because its operands are not cast to >> a larger data type before performing arithmetic. Thus, need >> to cast rpm to uint64_t. >> >> Found by Linux Verification Center (linuxtesting.org) with SVACE. >> >> Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru> >> > Reviewed-by: Patrick Leis <venture@google.com> > Reviewed-by: Hao Wu <wuhaotsh@google.com> > --- >> hw/misc/npcm7xx_mft.c | 5 +++-- >> 1 file changed, 3 insertions(+), 2 deletions(-) >> >> diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c >> index 9fcc69fe5c..e565cac05d 100644 >> --- a/hw/misc/npcm7xx_mft.c >> +++ b/hw/misc/npcm7xx_mft.c >> @@ -172,8 +172,9 @@ static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt( >> * RPM = revolution/min. The time for one revlution (in ns) is >> * MINUTE_TO_NANOSECOND / RPM. >> */ >> - count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) / >> - (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION)); >> + count = clock_ns_to_ticks(clock, >> + (uint64_t)(60 * NANOSECONDS_PER_SECOND) / >> + ((uint64_t)rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION)); >> } >> >> if (count > NPCM7XX_MFT_MAX_CNT) { >> -- >> 2.30.2 >> >> >>
diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c index 9fcc69fe5c..e565cac05d 100644 --- a/hw/misc/npcm7xx_mft.c +++ b/hw/misc/npcm7xx_mft.c @@ -172,8 +172,9 @@ static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt( * RPM = revolution/min. The time for one revlution (in ns) is * MINUTE_TO_NANOSECOND / RPM. */ - count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) / - (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION)); + count = clock_ns_to_ticks(clock, + (uint64_t)(60 * NANOSECONDS_PER_SECOND) / + ((uint64_t)rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION)); } if (count > NPCM7XX_MFT_MAX_CNT) {
The value of an arithmetic expression 'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject to overflow because its operands are not cast to a larger data type before performing arithmetic. Thus, need to cast rpm to uint64_t. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru> --- hw/misc/npcm7xx_mft.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)