On Fri Jun 13 14:21:53 2025 +0300, Cosmin Tanislav wrote:
> Switch to u64 arithmetic and use DIV_ROUND_CLOSEST_ULL() to avoid
> the overflow.
>
> buffer[i] is unsigned int and is limited by the lirc core to
> IR_MAX_DURATION, which is 500000.
>
> idata->freq is u32, which has a max value of 0xFFFFFFFF.
>
> In the case where buffer[i] is 500000, idata->freq overflows the u32
> multiplication for any values >= 8590.
>
> 0xFFFFFFFF / 500000 ~= 8589
>
> By casting buffer[i] to u64, idata->freq can be any u32 value without
> overflowing the multiplication.
>
> 0xFFFFFFFFFFFFFFFF / 500000 ~= 36893488147419 (> 4294967295)
>
> The result of the final operation will fit back into the unsigned int
> limits without any issues.
>
> 500000 * 0xFFFFFFFF / 1000000 = 0x80000000 (< 0xFFFFFFFF)
>
> Signed-off-by: Cosmin Tanislav <demonsin...@gmail.com>
> Signed-off-by: Sean Young <s...@mess.org>
> Signed-off-by: Hans Verkuil <hverk...@xs4all.nl>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/rc/ir-spi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/rc/ir-spi.c b/drivers/media/rc/ir-spi.c
index 0b54ad74cec0..392441e0c116 100644
--- a/drivers/media/rc/ir-spi.c
+++ b/drivers/media/rc/ir-spi.c
@@ -46,7 +46,8 @@ static int ir_spi_tx(struct rc_dev *dev, unsigned int
*buffer, unsigned int coun
/* convert the pulse/space signal to raw binary signal */
for (i = 0; i < count; i++) {
- buffer[i] = DIV_ROUND_CLOSEST(buffer[i] * idata->freq, 1000000);
+ buffer[i] = DIV_ROUND_CLOSEST_ULL((u64)buffer[i] * idata->freq,
+ 1000000);
len += buffer[i];
}
