hw/misc: cast rpm to uint64_t

[PATCH] hw/misc: cast rpm to uint64_t

Posted by Tigran Sogomonian 3 months, 1 week ago

The value of an arithmetic expression
'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject
to overflow because its operands are not cast to
a larger data type before performing arithmetic. Thus, need
to cast rpm to uint64_t.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru>
---
 hw/misc/npcm7xx_mft.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c
index 9fcc69fe5c..e565cac05d 100644
--- a/hw/misc/npcm7xx_mft.c
+++ b/hw/misc/npcm7xx_mft.c
@@ -172,8 +172,9 @@ static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt(
          * RPM = revolution/min. The time for one revlution (in ns) is
          * MINUTE_TO_NANOSECOND / RPM.
          */
-        count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) /
-            (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
+        count = clock_ns_to_ticks(clock,
+            (uint64_t)(60 * NANOSECONDS_PER_SECOND) /
+            ((uint64_t)rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
     }
 
     if (count > NPCM7XX_MFT_MAX_CNT) {
-- 
2.30.2

Re: [PATCH] hw/misc: cast rpm to uint64_t

Posted by Peter Maydell 2 months, 3 weeks ago

On Thu, 26 Dec 2024 at 13:59, Tigran Sogomonian
<tsogomonian@astralinux.ru> wrote:
>
> The value of an arithmetic expression
> 'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject
> to overflow because its operands are not cast to
> a larger data type before performing arithmetic. Thus, need
> to cast rpm to uint64_t.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru>


Applied to target-arm.next, thanks.

-- PMM

Re: [PATCH] hw/misc: cast rpm to uint64_t

Posted by Patrick Leis 3 months, 1 week ago

On Thu, Dec 26, 2024 at 6:00 AM Tigran Sogomonian <tsogomonian@astralinux.ru>
wrote:

> The value of an arithmetic expression
> 'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject
> to overflow because its operands are not cast to
> a larger data type before performing arithmetic. Thus, need
> to cast rpm to uint64_t.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru>
>
Reviewed-by: Patrick Leis <venture@google.com>

> ---
>  hw/misc/npcm7xx_mft.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c
> index 9fcc69fe5c..e565cac05d 100644
> --- a/hw/misc/npcm7xx_mft.c
> +++ b/hw/misc/npcm7xx_mft.c
> @@ -172,8 +172,9 @@ static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt(
>           * RPM = revolution/min. The time for one revlution (in ns) is
>           * MINUTE_TO_NANOSECOND / RPM.
>           */
> -        count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) /
> -            (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
> +        count = clock_ns_to_ticks(clock,
> +            (uint64_t)(60 * NANOSECONDS_PER_SECOND) /
> +            ((uint64_t)rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
>      }
>
>      if (count > NPCM7XX_MFT_MAX_CNT) {
> --
> 2.30.2
>
>
>

Re: [PATCH] hw/misc: cast rpm to uint64_t

Posted by Hao Wu 3 months, 1 week ago

On Fri, Dec 27, 2024 at 3:02 AM Patrick Leis <venture@google.com> wrote:

>
>
> On Thu, Dec 26, 2024 at 6:00 AM Tigran Sogomonian <
> tsogomonian@astralinux.ru> wrote:
>
>> The value of an arithmetic expression
>> 'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject
>> to overflow because its operands are not cast to
>> a larger data type before performing arithmetic. Thus, need
>> to cast rpm to uint64_t.
>>
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>>
>> Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru>
>>
> Reviewed-by: Patrick Leis <venture@google.com>
>
Reviewed-by: Hao Wu <wuhaotsh@google.com>

> ---
>>  hw/misc/npcm7xx_mft.c | 5 +++--
>>  1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c
>> index 9fcc69fe5c..e565cac05d 100644
>> --- a/hw/misc/npcm7xx_mft.c
>> +++ b/hw/misc/npcm7xx_mft.c
>> @@ -172,8 +172,9 @@ static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt(
>>           * RPM = revolution/min. The time for one revlution (in ns) is
>>           * MINUTE_TO_NANOSECOND / RPM.
>>           */
>> -        count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) /
>> -            (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
>> +        count = clock_ns_to_ticks(clock,
>> +            (uint64_t)(60 * NANOSECONDS_PER_SECOND) /
>> +            ((uint64_t)rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
>>      }
>>
>>      if (count > NPCM7XX_MFT_MAX_CNT) {
>> --
>> 2.30.2
>>
>>
>>