diff mbox series

[3/3] horizon: Casting type 32 to 64 bits.

Message ID 20240928142957.99143-1-shum.sdl@nppct.ru (mailing list archive)
State New
Headers show
Series None | expand

Commit Message

Andrey Shumilin Sept. 28, 2024, 2:29 p.m. UTC 
In one of the 3 cases, 1<<30 is passed as the second
parameter to the make_rate() function.
In the expressions "c << (CR_MAXPEXP+div-br_exp)"
and "c<<div" a shift of 14 is possible.
The INT type may overflow.
To fix this, it is suggested to cast the type.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Andrey Shumilin <shum.sdl@nppct.ru>
---
 drivers/atm/horizon.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
index 4f2951cbe69c..6f3e65e65225 100644
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -631,7 +631,7 @@  static int make_rate (const hrz_dev * dev, u32 c, rounding r,
 	// d == MIND and (c << (MAXPEXP+MIND)) < B
 	while (div < CR_MAXD) {
 		div++;
-		if (br_man <= (c << (CR_MAXPEXP+div-br_exp))) {
+		if (br_man <= ((u64)c << (CR_MAXPEXP+div-br_exp))) {
 			// Equivalent to: B <= (c << (MAXPEXP+d))
 			// c << (MAXPEXP+d-1) < B <= c << (MAXPEXP+d)
 			// 1 << (MAXPEXP-1) < B/2^d/c <= 1 << MAXPEXP
@@ -645,7 +645,7 @@  static int make_rate (const hrz_dev * dev, u32 c, rounding r,
 					pre = DIV_ROUND_CLOSEST(br, c<<div);
 					break;
 				default: /* round_up */
-					pre = br/(c<<div);
+					pre = br/((u64)c<<div);
 			}
 			PRINTD (DBG_QOS, "B: p=%u, d=%u", pre, div);
 			goto got_it;