| Message ID | 20210125234836.607233-1-wuhaotsh@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | hw/misc: Fix arith overflow in NPCM7XX PWM module | expand |
Hi Hao Wu, On 1/26/21 12:48 AM, wuhaotsh--- via wrote: > There's a potential arith overflow in npcm7xx_pwm_calculate_duty. > This patch fixes it. ^ not very useful information ;) What about the simplest approach Peter suggested, a 32-bit duty? > Thanks Peter for finding this out. Technically Coverity found this out. Using QEMU git tags, this is: Fixes: CID 1442342 Suggested-by: Peter Maydell <peter.maydell@linaro.org> > Signed-off-by: Hao Wu <wuhaotsh@google.com> > --- > hw/misc/npcm7xx_pwm.c | 4 ++-- > tests/qtest/npcm7xx_pwm-test.c | 2 +- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c > index e99e3cc7ef..90b4f630a0 100644 > --- a/hw/misc/npcm7xx_pwm.c > +++ b/hw/misc/npcm7xx_pwm.c > @@ -102,9 +102,9 @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p) > if (p->cnr == 0) { > duty = 0; > } else if (p->cmr >= p->cnr) { > - duty = NPCM7XX_PWM_MAX_DUTY; > + duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY; > } else { > - duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1); > + duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1); > } > } else { > duty = 0; > diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c > index 63557d2c06..f55571b31d 100644 > --- a/tests/qtest/npcm7xx_pwm-test.c > +++ b/tests/qtest/npcm7xx_pwm-test.c > @@ -280,7 +280,7 @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted) > } else if (cmr >= cnr) { > duty = MAX_DUTY; > } else { > - duty = MAX_DUTY * (cmr + 1) / (cnr + 1); > + duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1); > } > > if (inverted) { >
diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c index e99e3cc7ef..90b4f630a0 100644 --- a/hw/misc/npcm7xx_pwm.c +++ b/hw/misc/npcm7xx_pwm.c @@ -102,9 +102,9 @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p) if (p->cnr == 0) { duty = 0; } else if (p->cmr >= p->cnr) { - duty = NPCM7XX_PWM_MAX_DUTY; + duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY; } else { - duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1); + duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1); } } else { duty = 0; diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c index 63557d2c06..f55571b31d 100644 --- a/tests/qtest/npcm7xx_pwm-test.c +++ b/tests/qtest/npcm7xx_pwm-test.c @@ -280,7 +280,7 @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted) } else if (cmr >= cnr) { duty = MAX_DUTY; } else { - duty = MAX_DUTY * (cmr + 1) / (cnr + 1); + duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1); } if (inverted) {
There's a potential arith overflow in npcm7xx_pwm_calculate_duty. This patch fixes it. Thanks Peter for finding this out. Signed-off-by: Hao Wu <wuhaotsh@google.com> --- hw/misc/npcm7xx_pwm.c | 4 ++-- tests/qtest/npcm7xx_pwm-test.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)