Unverified Commit 9e141955 authored by Antonio Quartulli's avatar Antonio Quartulli Committed by Mark Brown
Browse files

spi-imx: prevent overflow when estimating transfer time 



The words delay is computed by multiplying two unsigned ints
and by adding up the result to a u64 variable.

The multiplication, however, is performed with 32bit math
thus losing data when the actual result is larger than UINT32_MAX.

Fix the operation by casting the first operand to u64, thus forcing
the multiplication to be performed with 64bit math.

This fixes 1 OVERFLOW_BEFORE_WIDEN issue reported by Coverity
Report: CID 1601859:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)

Cc: Mark Brown <broonie@kernel.org>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: imx@lists.linux.dev
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: default avatarAntonio Quartulli <antonio@mandelbit.com>
Link: https://patch.msgid.link/20241115220202.31086-1-antonio@mandelbit.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent c752e87b

drivers/spi/spi-imx.c

+1 −1
Original line number Diff line number Diff line
@@ -1685,7 +1685,7 @@ static unsigned int spi_imx_transfer_estimate_time_us(struct spi_transfer *trans 
		words = DIV_ROUND_UP(transfer->len * BITS_PER_BYTE, transfer->bits_per_word);

		word_delay_us = DIV_ROUND_CLOSEST(spi_delay_to_ns(&transfer->word_delay, transfer),

						  NSEC_PER_USEC);

		result += words * word_delay_us;

		result += (u64)words * word_delay_us;

	}



	return min(result, U32_MAX);