On Wed Mar 5 20:11:25 2025 +0500, Vitaliy Shevtsov wrote:
> [Why]
> There are several ns_to_ktime() calls that require using nanoseconds. It is
> better to replace them with us_to_ktime() to make code clear, getting rid
> of multiplication by 1000.
> 
> Also the timer function code may have an integer wrap-around issue. Since
> both tx_custom_low_usecs and tx_custom_high_usecs can be set to up to
> 9999999 from the user space via cec_pin_error_inj_parse_line(), this may
> cause usecs to be overflowed when adap->monitor_pin_cnt is zero and usecs
> is multiplied by 1000.
> 
> [How]
> Take advantage of using an appropriate helper func us_to_ktime() instead of
> ns_to_ktime() to improve readability and to make the code clearer. And this
> also mitigates possible integer wrap-arounds when usecs value is too large
> and it is multiplied by 1000.
> 
> Found by Linux Verification Center (linuxtesting.org) with Svace.
> 
> Signed-off-by: Vitaliy Shevtsov <v.shevt...@mt-integration.ru>
> Signed-off-by: Hans Verkuil <hverk...@xs4all.nl>

Patch committed.

Thanks,
Hans Verkuil

 drivers/media/cec/core/cec-pin.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

---

diff --git a/drivers/media/cec/core/cec-pin.c b/drivers/media/cec/core/cec-pin.c
index a70451d99ebc..f232c3df7ee1 100644
--- a/drivers/media/cec/core/cec-pin.c
+++ b/drivers/media/cec/core/cec-pin.c
@@ -873,19 +873,19 @@ static enum hrtimer_restart cec_pin_timer(struct hrtimer 
*timer)
                if (pin->wait_usecs > 150) {
                        pin->wait_usecs -= 100;
                        pin->timer_ts = ktime_add_us(ts, 100);
-                       hrtimer_forward_now(timer, ns_to_ktime(100000));
+                       hrtimer_forward_now(timer, us_to_ktime(100));
                        return HRTIMER_RESTART;
                }
                if (pin->wait_usecs > 100) {
                        pin->wait_usecs /= 2;
                        pin->timer_ts = ktime_add_us(ts, pin->wait_usecs);
                        hrtimer_forward_now(timer,
-                                       ns_to_ktime(pin->wait_usecs * 1000));
+                                       us_to_ktime(pin->wait_usecs));
                        return HRTIMER_RESTART;
                }
                pin->timer_ts = ktime_add_us(ts, pin->wait_usecs);
                hrtimer_forward_now(timer,
-                                   ns_to_ktime(pin->wait_usecs * 1000));
+                                   us_to_ktime(pin->wait_usecs));
                pin->wait_usecs = 0;
                return HRTIMER_RESTART;
        }
@@ -1020,13 +1020,12 @@ static enum hrtimer_restart cec_pin_timer(struct 
hrtimer *timer)
        if (!adap->monitor_pin_cnt || usecs <= 150) {
                pin->wait_usecs = 0;
                pin->timer_ts = ktime_add_us(ts, usecs);
-               hrtimer_forward_now(timer,
-                               ns_to_ktime(usecs * 1000));
+               hrtimer_forward_now(timer, us_to_ktime(usecs));
                return HRTIMER_RESTART;
        }
        pin->wait_usecs = usecs - 100;
        pin->timer_ts = ktime_add_us(ts, 100);
-       hrtimer_forward_now(timer, ns_to_ktime(100000));
+       hrtimer_forward_now(timer, us_to_ktime(100));
        return HRTIMER_RESTART;
 }
 

Reply via email to