* [PATCH] hw/misc: Fix arith overflow in NPCM7XX PWM module
@ 2021-01-25 23:48 wuhaotsh--- via
2021-01-26 6:56 ` Philippe Mathieu-Daudé
0 siblings, 1 reply; 2+ messages in thread
From: wuhaotsh--- via @ 2021-01-25 23:48 UTC (permalink / raw)
To: peter.maydell; +Cc: qemu-trivial, wuhaotsh, qemu-arm, qemu-devel, hskinnemoen
There's a potential arith overflow in npcm7xx_pwm_calculate_duty.
This patch fixes it.
Thanks Peter for finding this out.
Signed-off-by: Hao Wu <wuhaotsh@google.com>
---
hw/misc/npcm7xx_pwm.c | 4 ++--
tests/qtest/npcm7xx_pwm-test.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
index e99e3cc7ef..90b4f630a0 100644
--- a/hw/misc/npcm7xx_pwm.c
+++ b/hw/misc/npcm7xx_pwm.c
@@ -102,9 +102,9 @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
if (p->cnr == 0) {
duty = 0;
} else if (p->cmr >= p->cnr) {
- duty = NPCM7XX_PWM_MAX_DUTY;
+ duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY;
} else {
- duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
+ duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
}
} else {
duty = 0;
diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
index 63557d2c06..f55571b31d 100644
--- a/tests/qtest/npcm7xx_pwm-test.c
+++ b/tests/qtest/npcm7xx_pwm-test.c
@@ -280,7 +280,7 @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
} else if (cmr >= cnr) {
duty = MAX_DUTY;
} else {
- duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
+ duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1);
}
if (inverted) {
--
2.30.0.280.ga3ce27912f-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] hw/misc: Fix arith overflow in NPCM7XX PWM module
2021-01-25 23:48 [PATCH] hw/misc: Fix arith overflow in NPCM7XX PWM module wuhaotsh--- via
@ 2021-01-26 6:56 ` Philippe Mathieu-Daudé
0 siblings, 0 replies; 2+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-01-26 6:56 UTC (permalink / raw)
To: Hao Wu, peter.maydell; +Cc: qemu-trivial, qemu-arm, qemu-devel, hskinnemoen
Hi Hao Wu,
On 1/26/21 12:48 AM, wuhaotsh--- via wrote:
> There's a potential arith overflow in npcm7xx_pwm_calculate_duty.
> This patch fixes it.
^ not very useful information ;)
What about the simplest approach Peter suggested, a 32-bit duty?
> Thanks Peter for finding this out.
Technically Coverity found this out.
Using QEMU git tags, this is:
Fixes: CID 1442342
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Hao Wu <wuhaotsh@google.com>
> ---
> hw/misc/npcm7xx_pwm.c | 4 ++--
> tests/qtest/npcm7xx_pwm-test.c | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
> index e99e3cc7ef..90b4f630a0 100644
> --- a/hw/misc/npcm7xx_pwm.c
> +++ b/hw/misc/npcm7xx_pwm.c
> @@ -102,9 +102,9 @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
> if (p->cnr == 0) {
> duty = 0;
> } else if (p->cmr >= p->cnr) {
> - duty = NPCM7XX_PWM_MAX_DUTY;
> + duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY;
> } else {
> - duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
> + duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
> }
> } else {
> duty = 0;
> diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
> index 63557d2c06..f55571b31d 100644
> --- a/tests/qtest/npcm7xx_pwm-test.c
> +++ b/tests/qtest/npcm7xx_pwm-test.c
> @@ -280,7 +280,7 @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
> } else if (cmr >= cnr) {
> duty = MAX_DUTY;
> } else {
> - duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
> + duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1);
> }
>
> if (inverted) {
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-01-26 6:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-25 23:48 [PATCH] hw/misc: Fix arith overflow in NPCM7XX PWM module wuhaotsh--- via
2021-01-26 6:56 ` Philippe Mathieu-Daudé
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.