lkml.org 
[lkml]   [2019]   [Aug]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 55/78] staging: comedi: dt3000: Fix signed integer overflow divider * base
    Date
    From: Ian Abbott <abbotti@mev.co.uk>

    commit b4d98bc3fc93ec3a58459948a2c0e0c9b501cd88 upstream.

    In `dt3k_ns_to_timer()` the following lines near the end of the function
    result in a signed integer overflow:

    prescale = 15;
    base = timer_base * (1 << prescale);
    divider = 65535;
    *nanosec = divider * base;

    (`divider`, `base` and `prescale` are type `int`, `timer_base` and
    `*nanosec` are type `unsigned int`. The value of `timer_base` will be
    either 50 or 100.)

    The main reason for the overflow is that the calculation for `base` is
    completely wrong. It should be:

    base = timer_base * (prescale + 1);

    which matches an earlier instance of this calculation in the same
    function.

    Reported-by: David Binderman <dcb314@hotmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Link: https://lore.kernel.org/r/20190812111517.26803-1-abbotti@mev.co.uk
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/staging/comedi/drivers/dt3000.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/staging/comedi/drivers/dt3000.c
    +++ b/drivers/staging/comedi/drivers/dt3000.c
    @@ -377,7 +377,7 @@ static int dt3k_ns_to_timer(unsigned int
    }

    prescale = 15;
    - base = timer_base * (1 << prescale);
    + base = timer_base * (prescale + 1);
    divider = 65535;
    *nanosec = divider * base;
    return (prescale << 16) | (divider);

    \
     
     \ /
      Last update: 2019-08-22 19:56    [W:3.044 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site