* [PATCH][next] thunderbolt: ensure left shift of 512 does not overflow a 32 bit int
@ 2020-06-30 14:55 Colin King
2020-07-01 10:50 ` Mika Westerberg
0 siblings, 1 reply; 2+ messages in thread
From: Colin King @ 2020-06-30 14:55 UTC (permalink / raw)
To: Andreas Noever, Michael Jamet, Mika Westerberg, Yehezkel Bernat,
linux-usb
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
The 32 bit int value 512 is being left shifted and then used in a context
that expects the expression to be a larger unsigned long. There may be
a potential integer overflow, so make 512 a UL before shift to avoid
any such issues.
Addresses-Coverity: ("Uninintentional integer overflow")
Fixes: 3b1d8d577ca8 ("thunderbolt: Implement USB3 bandwidth negotiation routines")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/thunderbolt/usb4.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c
index d1a554fd09ae..ed609075cf66 100644
--- a/drivers/thunderbolt/usb4.c
+++ b/drivers/thunderbolt/usb4.c
@@ -909,7 +909,7 @@ static unsigned int usb3_bw_to_mbps(u32 bw, u8 scale)
{
unsigned long uframes;
- uframes = bw * 512 << scale;
+ uframes = bw * 512UL << scale;
return DIV_ROUND_CLOSEST(uframes * 8000, 1000 * 1000);
}
@@ -919,7 +919,7 @@ static u32 mbps_to_usb3_bw(unsigned int mbps, u8 scale)
/* 1 uframe is 1/8 ms (125 us) -> 1 / 8000 s */
uframes = ((unsigned long)mbps * 1000 * 1000) / 8000;
- return DIV_ROUND_UP(uframes, 512 << scale);
+ return DIV_ROUND_UP(uframes, 512UL << scale);
}
static int usb4_usb3_port_read_allocated_bandwidth(struct tb_port *port,
--
2.27.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH][next] thunderbolt: ensure left shift of 512 does not overflow a 32 bit int
2020-06-30 14:55 [PATCH][next] thunderbolt: ensure left shift of 512 does not overflow a 32 bit int Colin King
@ 2020-07-01 10:50 ` Mika Westerberg
0 siblings, 0 replies; 2+ messages in thread
From: Mika Westerberg @ 2020-07-01 10:50 UTC (permalink / raw)
To: Colin King
Cc: Andreas Noever, Michael Jamet, Yehezkel Bernat, linux-usb,
kernel-janitors, linux-kernel
On Tue, Jun 30, 2020 at 03:55:58PM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The 32 bit int value 512 is being left shifted and then used in a context
> that expects the expression to be a larger unsigned long. There may be
> a potential integer overflow, so make 512 a UL before shift to avoid
> any such issues.
>
> Addresses-Coverity: ("Uninintentional integer overflow")
> Fixes: 3b1d8d577ca8 ("thunderbolt: Implement USB3 bandwidth negotiation routines")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Applied, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-07-01 10:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-30 14:55 [PATCH][next] thunderbolt: ensure left shift of 512 does not overflow a 32 bit int Colin King
2020-07-01 10:50 ` Mika Westerberg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).