From: "Krzysztof Hałasa" <khalasa@piap.pl>
To: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: Sakari Ailus <sakari.ailus@linux.intel.com>,
linux-kernel@vger.kernel.org, linux-media@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH v2 08/13] media: ar0521: don't overflow when checking PLL values
Date: Fri, 18 Oct 2024 11:53:11 +0200 [thread overview]
Message-ID: <m3ldylka9k.fsf@t19.piap.pl> (raw)
In-Reply-To: <384bc1320658b93b43838a337b37d52dc8485df2.1729230718.git.mchehab+huawei@kernel.org> (Mauro Carvalho Chehab's message of "Fri, 18 Oct 2024 07:53:10 +0200")
Hi Mauro,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org> writes:
> The PLL checks are comparing 64 bit integers with 32 bit
> ones, as reported by Coverity. Depending on the values of
> the variables, this may underflow.
>
> Fix it ensuring that both sides of the expression are u64.
>
> Fixes: 852b50aeed15 ("media: On Semi AR0521 sensor driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Krzysztof Hałasa <khalasa@piap.pl>
> --- a/drivers/media/i2c/ar0521.c
> +++ b/drivers/media/i2c/ar0521.c
> @@ -255,10 +255,10 @@ static u32 calc_pll(struct ar0521_dev *sensor, u32 freq, u16 *pre_ptr, u16 *mult
> continue; /* Minimum value */
> if (new_mult > 254)
> break; /* Maximum, larger pre won't work either */
> - if (sensor->extclk_freq * (u64)new_mult < AR0521_PLL_MIN *
> + if (sensor->extclk_freq * (u64)new_mult < (u64)AR0521_PLL_MIN *
> new_pre)
> continue;
> - if (sensor->extclk_freq * (u64)new_mult > AR0521_PLL_MAX *
> + if (sensor->extclk_freq * (u64)new_mult > (u64)AR0521_PLL_MAX *
> new_pre)
> break; /* Larger pre won't work either */
> new_pll = div64_round_up(sensor->extclk_freq * (u64)new_mult,
--
Krzysztof "Chris" Hałasa
Sieć Badawcza Łukasiewicz
Przemysłowy Instytut Automatyki i Pomiarów PIAP
Al. Jerozolimskie 202, 02-486 Warszawa
next prev parent reply other threads:[~2024-10-18 9:58 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-18 5:53 [PATCH v2 00/13] Media: fix several issues on drivers Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 01/13] media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() Mauro Carvalho Chehab
2024-10-18 6:13 ` Hans Verkuil
2024-10-18 6:26 ` Mauro Carvalho Chehab
2024-10-21 18:32 ` Dan Carpenter
2024-10-18 5:53 ` [PATCH v2 02/13] media: v4l2-tpg: prevent the risk of a division by zero Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 03/13] media: dvbdev: prevent the risk of out of memory access Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 04/13] media: dvb_frontend: don't play tricks with underflow values Mauro Carvalho Chehab
2024-10-18 11:44 ` Philipp Stanner
2024-10-18 14:37 ` Kees Cook
2024-10-18 16:02 ` Philipp Stanner
2024-10-19 6:39 ` Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 05/13] media: mgb4: protect driver against spectre Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 06/13] media: av7110: fix a spectre vulnerability Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 07/13] media: s5p-jpeg: prevent buffer overflows Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 08/13] media: ar0521: don't overflow when checking PLL values Mauro Carvalho Chehab
2024-10-18 9:53 ` Krzysztof Hałasa [this message]
2024-10-18 5:53 ` [PATCH v2 09/13] media: cx24116: prevent overflows on SNR calculus Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 10/13] media: adv7604: prevent underflow condition when reporting colorspace Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 11/13] media: stb0899_algo: initialize cfr before using it Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 12/13] media: cec: extron-da-hd-4k-plus: don't use -1 as an error code Mauro Carvalho Chehab
2024-10-18 5:53 ` [PATCH v2 13/13] media: pulse8-cec: fix data timestamp at pulse8_setup() Mauro Carvalho Chehab
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=m3ldylka9k.fsf@t19.piap.pl \
--to=khalasa@piap.pl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+huawei@kernel.org \
--cc=sakari.ailus@linux.intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.