On Fri, Dec 27, 2024 at 3:02 AM Patrick Leis <vent...@google.com> wrote:
>
>
> On Thu, Dec 26, 2024 at 6:00 AM Tigran Sogomonian <
> tsogomon...@astralinux.ru> wrote:
>
>> The value of an arithmetic expression
>> 'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject
>> to overflow because its operands are not cast to
>> a larger data type before performing arithmetic. Thus, need
>> to cast rpm to uint64_t.
>>
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>>
>> Signed-off-by: Tigran Sogomonian <tsogomon...@astralinux.ru>
>>
> Reviewed-by: Patrick Leis <vent...@google.com>
>
Reviewed-by: Hao Wu <wuhao...@google.com>
> ---
>> hw/misc/npcm7xx_mft.c | 5 +++--
>> 1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c
>> index 9fcc69fe5c..e565cac05d 100644
>> --- a/hw/misc/npcm7xx_mft.c
>> +++ b/hw/misc/npcm7xx_mft.c
>> @@ -172,8 +172,9 @@ static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt(
>> * RPM = revolution/min. The time for one revlution (in ns) is
>> * MINUTE_TO_NANOSECOND / RPM.
>> */
>> - count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) /
>> - (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
>> + count = clock_ns_to_ticks(clock,
>> + (uint64_t)(60 * NANOSECONDS_PER_SECOND) /
>> + ((uint64_t)rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
>> }
>>
>> if (count > NPCM7XX_MFT_MAX_CNT) {
>> --
>> 2.30.2
>>
>>
>>
