Skip to content

Commit

Permalink
spi-imx: prevent overflow when estimating transfer time
Browse files Browse the repository at this point in the history
The words delay is computed by multiplying two unsigned ints
and by adding up the result to a u64 variable.

The multiplication, however, is performed with 32bit math
thus losing data when the actual result is larger than UINT32_MAX.

Fix the operation by casting the first operand to u64, thus forcing
the multiplication to be performed with 64bit math.

This fixes 1 OVERFLOW_BEFORE_WIDEN issue reported by Coverity
Report: CID 1601859:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)

Cc: Mark Brown <broonie@kernel.org>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: imx@lists.linux.dev
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
Link: https://patch.msgid.link/20241115220202.31086-1-antonio@mandelbit.com
Signed-off-by: Mark Brown <broonie@kernel.org>
  • Loading branch information
Antonio Quartulli authored and Mark Brown committed Nov 21, 2024
1 parent c752e87 commit 9e14195
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/spi/spi-imx.c
Original file line number Diff line number Diff line change
Expand Up @@ -1685,7 +1685,7 @@ static unsigned int spi_imx_transfer_estimate_time_us(struct spi_transfer *trans
words = DIV_ROUND_UP(transfer->len * BITS_PER_BYTE, transfer->bits_per_word);
word_delay_us = DIV_ROUND_CLOSEST(spi_delay_to_ns(&transfer->word_delay, transfer),
NSEC_PER_USEC);
result += words * word_delay_us;
result += (u64)words * word_delay_us;
}

return min(result, U32_MAX);
Expand Down

0 comments on commit 9e14195

Please sign in to comment.