On Thu, Dec 26, 2024 at 6:00 AM Tigran Sogomonian <tsogomon...@astralinux.ru>
wrote:
> The value of an arithmetic expression
> 'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject
> to overflow because its operands are not cast to
> a larger data type before performing arithmetic. Thus, need
> to cast rpm to uint64_t.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Tigran Sogomonian <tsogomon...@astralinux.ru>
>
Reviewed-by: Patrick Leis <vent...@google.com>
> ---
> hw/misc/npcm7xx_mft.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c
> index 9fcc69fe5c..e565cac05d 100644
> --- a/hw/misc/npcm7xx_mft.c
> +++ b/hw/misc/npcm7xx_mft.c
> @@ -172,8 +172,9 @@ static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt(
> * RPM = revolution/min. The time for one revlution (in ns) is
> * MINUTE_TO_NANOSECOND / RPM.
> */
> - count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) /
> - (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
> + count = clock_ns_to_ticks(clock,
> + (uint64_t)(60 * NANOSECONDS_PER_SECOND) /
> + ((uint64_t)rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
> }
>
> if (count > NPCM7XX_MFT_MAX_CNT) {
> --
> 2.30.2
>
>
>
