[PATCH] hw/misc: Fix arith overflow in NPCM7XX PWM module

[PATCH] hw/misc: Fix arith overflow in NPCM7XX PWM module

[wuhaotsh--- via]

There's a potential arith overflow in npcm7xx_pwm_calculate_duty.
This patch fixes it.

Thanks Peter for finding this out.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
---
 hw/misc/npcm7xx_pwm.c          | 4 ++--
 tests/qtest/npcm7xx_pwm-test.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
index e99e3cc7ef..90b4f630a0 100644
--- a/hw/misc/npcm7xx_pwm.c
+++ b/hw/misc/npcm7xx_pwm.c
@@ -102,9 +102,9 @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
         if (p->cnr == 0) {
             duty = 0;
         } else if (p->cmr >= p->cnr) {
-            duty = NPCM7XX_PWM_MAX_DUTY;
+            duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY;
         } else {
-            duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
+            duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
         }
     } else {
         duty = 0;
diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
index 63557d2c06..f55571b31d 100644
--- a/tests/qtest/npcm7xx_pwm-test.c
+++ b/tests/qtest/npcm7xx_pwm-test.c
@@ -280,7 +280,7 @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
     } else if (cmr >= cnr) {
         duty = MAX_DUTY;
     } else {
-        duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
+        duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1);
     }
 
     if (inverted) {
-- 
2.30.0.280.ga3ce27912f-goog

Re: [PATCH] hw/misc: Fix arith overflow in NPCM7XX PWM module

[Philippe Mathieu-Daudé]

Hi Hao Wu,

On 1/26/21 12:48 AM, wuhaotsh--- via wrote:
> There's a potential arith overflow in npcm7xx_pwm_calculate_duty.

> This patch fixes it.

  ^ not very useful information ;)

What about the simplest approach Peter suggested, a 32-bit duty?

> Thanks Peter for finding this out.

Technically Coverity found this out.
Using QEMU git tags, this is:

Fixes: CID 1442342
Suggested-by: Peter Maydell <peter.maydell@linaro.org>

> Signed-off-by: Hao Wu <wuhaotsh@google.com>
> ---
>  hw/misc/npcm7xx_pwm.c          | 4 ++--
>  tests/qtest/npcm7xx_pwm-test.c | 2 +-
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
> index e99e3cc7ef..90b4f630a0 100644
> --- a/hw/misc/npcm7xx_pwm.c
> +++ b/hw/misc/npcm7xx_pwm.c
> @@ -102,9 +102,9 @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
>          if (p->cnr == 0) {
>              duty = 0;
>          } else if (p->cmr >= p->cnr) {
> -            duty = NPCM7XX_PWM_MAX_DUTY;
> +            duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY;
>          } else {
> -            duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
> +            duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
>          }
>      } else {
>          duty = 0;
> diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
> index 63557d2c06..f55571b31d 100644
> --- a/tests/qtest/npcm7xx_pwm-test.c
> +++ b/tests/qtest/npcm7xx_pwm-test.c
> @@ -280,7 +280,7 @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
>      } else if (cmr >= cnr) {
>          duty = MAX_DUTY;
>      } else {
> -        duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
> +        duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1);
>      }
>  
>      if (inverted) {
>