From: Ricardo Ribalda <ribalda@chromium.org>
To: Martin Tuma <martin.tuma@digiteqautomotive.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
Hugues Fruchet <hugues.fruchet@foss.st.com>,
Alain Volmat <alain.volmat@foss.st.com>,
Maxime Coquelin <mcoquelin.stm32@gmail.com>,
Alexandre Torgue <alexandre.torgue@foss.st.com>,
Paul Kocialkowski <paul.kocialkowski@bootlin.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Chen-Yu Tsai <wens@csie.org>,
Jernej Skrabec <jernej.skrabec@gmail.com>,
Samuel Holland <samuel@sholland.org>,
Sakari Ailus <sakari.ailus@linux.intel.com>,
Thierry Reding <thierry.reding@gmail.com>,
Jonathan Hunter <jonathanh@nvidia.com>,
Sowjanya Komatineni <skomatineni@nvidia.com>,
Luca Ceresoli <luca.ceresoli@bootlin.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@collabora.com>,
Hans Verkuil <hverkuil@xs4all.nl>,
Sergey Kozlov <serjk@netup.ru>, Abylay Ospan <aospan@netup.ru>,
Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>,
Dmitry Osipenko <digetx@gmail.com>,
Benjamin Mugnier <benjamin.mugnier@foss.st.com>,
Sylvain Petinot <sylvain.petinot@foss.st.com>,
Stanimir Varbanov <stanimir.k.varbanov@gmail.com>,
Vikash Garodia <quic_vgarodia@quicinc.com>,
Bryan O'Donoghue <bryan.odonoghue@linaro.org>,
Bjorn Andersson <andersson@kernel.org>,
Konrad Dybcio <konrad.dybcio@linaro.org>
Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-stm32@st-md-mailman.stormreply.com,
linux-arm-kernel@lists.infradead.org,
linux-staging@lists.linux.dev, linux-sunxi@lists.linux.dev,
linux-tegra@vger.kernel.org, linux-mediatek@lists.infradead.org,
linux-arm-msm@vger.kernel.org,
Ricardo Ribalda <ribalda@chromium.org>,
Dan Carpenter <dan.carpenter@linaro.org>
Subject: [PATCH v3 25/26] media: dvb-frontends: tda10048: Fix integer overflow
Date: Mon, 29 Apr 2024 15:05:04 +0000 [thread overview]
Message-ID: <20240429-fix-cocci-v3-25-3c4865f5a4b0@chromium.org> (raw)
In-Reply-To: <20240429-fix-cocci-v3-0-3c4865f5a4b0@chromium.org>
state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer
when multiplied by pll_mfactor.
Create a new 64 bit variable to hold the calculations.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
drivers/media/dvb-frontends/tda10048.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/dvb-frontends/tda10048.c b/drivers/media/dvb-frontends/tda10048.c
index 5d5e4e9e4422..3e725cdcc66b 100644
--- a/drivers/media/dvb-frontends/tda10048.c
+++ b/drivers/media/dvb-frontends/tda10048.c
@@ -410,6 +410,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)
struct tda10048_config *config = &state->config;
int i;
u32 if_freq_khz;
+ u64 sample_freq;
dprintk(1, "%s(bw = %d)\n", __func__, bw);
@@ -451,9 +452,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)
dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor);
/* Calculate the sample frequency */
- state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45);
- state->sample_freq /= (state->pll_nfactor + 1);
- state->sample_freq /= (state->pll_pfactor + 4);
+ sample_freq = state->xtal_hz;
+ sample_freq *= state->pll_mfactor + 45;
+ do_div(sample_freq, state->pll_nfactor + 1);
+ do_div(sample_freq, state->pll_pfactor + 4);
+ state->sample_freq = sample_freq;
dprintk(1, "- sample_freq = %d\n", state->sample_freq);
/* Update the I/F */
--
2.44.0.769.g3c40516874-goog
next prev parent reply other threads:[~2024-04-29 15:05 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-29 15:04 [PATCH v3 00/26] media: Fix coccinelle warning/errors Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 01/26] media: pci: mgb4: Refactor struct resources Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 02/26] media: stb0899: Simplify check Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 03/26] media: uvcvideo: Refactor iterators Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 04/26] media: uvcvideo: Use max() macro Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 05/26] media: go7007: Use min and max macros Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 06/26] media: stm32-dcmipp: Remove redundant printk Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 07/26] media: staging: sun6i-isp: " Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 08/26] media: dvb-frontends: tda18271c2dd: Remove casting during div Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 09/26] media: v4l: async: refactor v4l2_async_create_ancillary_links Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 10/26] staging: media: tegra-video: Use swap macro Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 11/26] media: s2255: Use refcount_t instead of atomic_t for num_channels Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 12/26] media: platform: mtk-mdp3: Use refcount_t for job_count Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 13/26] media: common: saa7146: Use min macro Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 14/26] media: dvb-frontends: drx39xyj: " Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 15/26] media: netup_unidvb: " Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 16/26] media: au0828: Use umin macro Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 17/26] media: flexcop-usb: Use min macro Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 18/26] media: gspca: cpia1: " Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 19/26] media: stk1160: " Ricardo Ribalda
2024-04-29 15:04 ` [PATCH v3 20/26] media: tegra-vde: Refactor timeout handling Ricardo Ribalda
2024-04-29 15:05 ` [PATCH v3 21/26] media: i2c: st-mipid02: Use the correct div function Ricardo Ribalda
2024-04-29 15:05 ` [PATCH v3 22/26] media: tc358746: Use the correct div_ function Ricardo Ribalda
2024-04-29 15:05 ` [PATCH v3 23/26] media: venus: vdec: Make the range of us_per_frame explicit Ricardo Ribalda
2024-04-29 15:05 ` [PATCH v3 24/26] media: venus: venc: " Ricardo Ribalda
2024-04-29 15:05 ` Ricardo Ribalda [this message]
2024-04-29 15:05 ` [PATCH v3 26/26] media: dvb-frontends: tda10048: Make the range of z explicit Ricardo Ribalda
2024-05-03 10:27 ` Mauro Carvalho Chehab
2024-05-03 11:55 ` Dan Carpenter
2024-05-03 11:56 ` Ricardo Ribalda
2024-05-03 14:08 ` Dragan Simic
2024-05-13 13:35 ` Ricardo Ribalda
2024-05-13 14:25 ` Michael Ira Krufky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240429-fix-cocci-v3-25-3c4865f5a4b0@chromium.org \
--to=ribalda@chromium.org \
--cc=alain.volmat@foss.st.com \
--cc=alexandre.torgue@foss.st.com \
--cc=andersson@kernel.org \
--cc=angelogioacchino.delregno@collabora.com \
--cc=aospan@netup.ru \
--cc=benjamin.mugnier@foss.st.com \
--cc=bryan.odonoghue@linaro.org \
--cc=dan.carpenter@linaro.org \
--cc=digetx@gmail.com \
--cc=ezequiel@vanguardiasur.com.ar \
--cc=gregkh@linuxfoundation.org \
--cc=hugues.fruchet@foss.st.com \
--cc=hverkuil@xs4all.nl \
--cc=jernej.skrabec@gmail.com \
--cc=jonathanh@nvidia.com \
--cc=konrad.dybcio@linaro.org \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-staging@lists.linux.dev \
--cc=linux-stm32@st-md-mailman.stormreply.com \
--cc=linux-sunxi@lists.linux.dev \
--cc=linux-tegra@vger.kernel.org \
--cc=luca.ceresoli@bootlin.com \
--cc=martin.tuma@digiteqautomotive.com \
--cc=matthias.bgg@gmail.com \
--cc=mchehab@kernel.org \
--cc=mcoquelin.stm32@gmail.com \
--cc=paul.kocialkowski@bootlin.com \
--cc=quic_vgarodia@quicinc.com \
--cc=sakari.ailus@linux.intel.com \
--cc=samuel@sholland.org \
--cc=serjk@netup.ru \
--cc=skomatineni@nvidia.com \
--cc=stanimir.k.varbanov@gmail.com \
--cc=sylvain.petinot@foss.st.com \
--cc=thierry.reding@gmail.com \
--cc=wens@csie.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).