From patchwork Tue Dec 3 16:25:23 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anastasia Belova X-Patchwork-Id: 13892677 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A0552E74AC3 for ; Tue, 3 Dec 2024 16:26:29 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tIViu-0005mR-G9; Tue, 03 Dec 2024 11:26:05 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tIVin-0005kx-Cv; Tue, 03 Dec 2024 11:25:57 -0500 Received: from mail-gw02.astralinux.ru ([195.16.41.108]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tIVik-0007qi-PE; Tue, 03 Dec 2024 11:25:56 -0500 Received: from gca-msk-a-srv-ksmg01.astralinux.ru (localhost [127.0.0.1]) by mail-gw02.astralinux.ru (Postfix) with ESMTP id 158521FA08; Tue, 3 Dec 2024 19:25:44 +0300 (MSK) Received: from new-mail.astralinux.ru (gca-yc-ruca-srv-mail03.astralinux.ru [10.177.185.108]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail-gw02.astralinux.ru (Postfix) with ESMTPS; Tue, 3 Dec 2024 19:25:41 +0300 (MSK) Received: from localhost.localdomain (unknown [10.198.4.245]) by new-mail.astralinux.ru (Postfix) with ESMTPA id 4Y2mGp2FhJz1gywd; Tue, 3 Dec 2024 19:25:36 +0300 (MSK) From: Anastasia Belova To: Joel Stanley , qemu-devel@nongnu.org Cc: Anastasia Belova , Peter Maydell , qemu-arm@nongnu.org, sdl.qemu@linuxtesting.org Subject: [PATCH] hw/timer/nrf51_timer: prevent integer overflow Date: Tue, 3 Dec 2024 19:25:23 +0300 Message-ID: <20241203162525.75156-1-abelova@astralinux.ru> X-Mailer: git-send-email 2.47.0 MIME-Version: 1.0 X-KSMG-AntiPhishing: NotDetected X-KSMG-AntiSpam-Auth: dkim=none X-KSMG-AntiSpam-Envelope-From: abelova@astralinux.ru X-KSMG-AntiSpam-Info: LuaCore: 44 0.3.44 5149b91aab9eaefa5f6630aab0c7a7210c633ab6, {Tracking_from_domain_doesnt_match_to}, astralinux.ru:7.1.1; d41d8cd98f00b204e9800998ecf8427e.com:7.1.1; new-mail.astralinux.ru:7.1.1; 127.0.0.199:7.1.2, FromAlignment: s X-KSMG-AntiSpam-Interceptor-Info: scan successful X-KSMG-AntiSpam-Lua-Profiles: 189586 [Dec 03 2024] X-KSMG-AntiSpam-Method: none X-KSMG-AntiSpam-Rate: 0 X-KSMG-AntiSpam-Status: not_detected X-KSMG-AntiSpam-Version: 6.1.1.7 X-KSMG-AntiVirus: Kaspersky Secure Mail Gateway, version 2.1.0.7854, bases: 2024/12/03 11:06:00 #26930054 X-KSMG-AntiVirus-Status: NotDetected, skipped X-KSMG-LinksScanning: NotDetected X-KSMG-Message-Action: skipped X-KSMG-Rule-ID: 1 Received-SPF: pass client-ip=195.16.41.108; envelope-from=abelova@astralinux.ru; helo=mail-gw02.astralinux.ru X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Both counter and tick are uint32_t and the result of their addition may not fit this type. Add explicit casting to uint64_t. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c5a4829c08 ("hw/timer/nrf51_timer: Add nRF51 Timer peripheral") Signed-off-by: Anastasia Belova --- hw/timer/nrf51_timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/timer/nrf51_timer.c b/hw/timer/nrf51_timer.c index 35b0e62d5b..b5ff235eb8 100644 --- a/hw/timer/nrf51_timer.c +++ b/hw/timer/nrf51_timer.c @@ -44,7 +44,7 @@ static uint32_t update_counter(NRF51TimerState *s, int64_t now) { uint32_t ticks = ns_to_ticks(s, now - s->update_counter_ns); - s->counter = (s->counter + ticks) % BIT(bitwidths[s->bitmode]); + s->counter = ((uint64_t)s->counter + ticks) % BIT(bitwidths[s->bitmode]); /* * Only advance the sync time to the timestamp of the last tick, * not all the way to 'now', so we don't lose time if we do