From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, linux-clk@vger.kernel.org,
Pawel Moll <pawel.moll@arm.com>,
Linus Walleij <linus.walleij@linaro.org>,
Russell King <rmk+kernel@arm.linux.org.uk>
Subject: [PATCH 3.10 35/54] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz()
Date: Tue, 23 Feb 2016 19:33:52 -0800 [thread overview]
Message-ID: <20160224033353.834213590@linuxfoundation.org> (raw)
In-Reply-To: <20160224033352.613205610@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 5070fb14a0154f075c8b418e5bc58a620ae85a45 upstream.
When trying to set the ICST 307 clock to 25174000 Hz I ran into
this arithmetic error: the icst_hz_to_vco() correctly figure out
DIVIDE=2, RDW=100 and VDW=99 yielding a frequency of
25174000 Hz out of the VCO. (I replicated the icst_hz() function
in a spreadsheet to verify this.)
However, when I called icst_hz() on these VCO settings it would
instead return 4122709 Hz. This causes an error in the common
clock driver for ICST as the common clock framework will call
.round_rate() on the clock which will utilize icst_hz_to_vco()
followed by icst_hz() suggesting the erroneous frequency, and
then the clock gets set to this.
The error did not manifest in the old clock framework since
this high frequency was only used by the CLCD, which calls
clk_set_rate() without first calling clk_round_rate() and since
the old clock framework would not call clk_round_rate() before
setting the frequency, the correct values propagated into
the VCO.
After some experimenting I figured out that it was due to a simple
arithmetic overflow: the divisor for 24Mhz reference frequency
as reference becomes 24000000*2*(99+8)=0x132212400 and the "1"
in bit 32 overflows and is lost.
But introducing an explicit 64-by-32 bit do_div() and casting
the divisor into (u64) we get the right frequency back, and the
right frequency gets set.
Tested on the ARM Versatile.
Cc: linux-clk@vger.kernel.org
Cc: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/common/icst.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/arch/arm/common/icst.c
+++ b/arch/arm/common/icst.c
@@ -16,7 +16,7 @@
*/
#include <linux/module.h>
#include <linux/kernel.h>
-
+#include <asm/div64.h>
#include <asm/hardware/icst.h>
/*
@@ -29,7 +29,11 @@ EXPORT_SYMBOL(icst525_s2div);
unsigned long icst_hz(const struct icst_params *p, struct icst_vco vco)
{
- return p->ref * 2 * (vco.v + 8) / ((vco.r + 2) * p->s2div[vco.s]);
+ u64 dividend = p->ref * 2 * (u64)(vco.v + 8);
+ u32 divisor = (vco.r + 2) * p->s2div[vco.s];
+
+ do_div(dividend, divisor);
+ return (unsigned long)dividend;
}
EXPORT_SYMBOL(icst_hz);
next prev parent reply other threads:[~2016-02-24 3:55 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-24 3:33 [PATCH 3.10 00/54] 3.10.98-stable review Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 01/54] ALSA: seq: Fix double port list deletion Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 02/54] wan/x25: Fix use-after-free in x25_asy_open_tty() Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 03/54] staging/speakup: Use tty_ldisc_ref() for paste kworker Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 04/54] pty: fix possible use after free of tty->driver_data Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 05/54] pty: make sure super_block is still valid in final /dev/tty close Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 06/54] AIO: properly check iovec sizes Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 07/54] ext4: fix potential integer overflow Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 08/54] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 10/54] ptrace: use fsuid, fsgid, effective creds for fs access checks Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 11/54] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 12/54] tracing: Fix freak link error caused by branch tracer Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 13/54] klist: fix starting point removed bug in klist iterators Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 14/54] scsi: restart list search after unlock in scsi_remove_target Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 15/54] scsi_sysfs: Fix queue_ramp_up_period return code Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 16/54] iscsi-target: Fix rx_login_comp hang after login failure Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 17/54] Fix a memory leak in scsi_host_dev_release() Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 18/54] SCSI: Fix NULL pointer dereference in runtime PM Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 19/54] iscsi-target: Fix potential dead-lock during node acl delete Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 20/54] SCSI: fix crashes in sd and sr runtime PM Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 21/54] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 22/54] scsi_dh_rdac: always retry MODE SELECT on command lock violation Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 23/54] scsi: fix soft lockup in scsi_remove_target() on module removal Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 24/54] iio:ad7793: Fix ad7785 product ID Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 25/54] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 26/54] iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 27/54] iio: adis_buffer: Fix out-of-bounds memory access Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 28/54] iio: dac: mcp4725: set iio name property in sysfs Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 29/54] cifs: fix erroneous return value Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 30/54] nfs: Fix race in __update_open_stateid() Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 31/54] udf: limit the maximum number of indirect extents in a row Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 32/54] udf: Prevent buffer overrun with multi-byte characters Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 33/54] udf: Check output buffer length when converting name to CS0 Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 34/54] ARM: 8519/1: ICST: try other dividends than 1 Greg Kroah-Hartman
2016-02-24 3:33 ` Greg Kroah-Hartman [this message]
2016-02-24 3:33 ` [PATCH 3.10 36/54] fuse: break infinite loop in fuse_fill_write_pages() Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 37/54] mm: soft-offline: check return value in second __get_any_page() call Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 38/54] Input: elantech - add Fujitsu Lifebook U745 to force crc_enabled Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 39/54] Input: elantech - mark protocols v2 and v3 as semi-mt Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 41/54] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Greg Kroah-Hartman
2016-02-24 3:33 ` [PATCH 3.10 42/54] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 43/54] xhci: Fix list corruption in urb dequeue at host removal Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 44/54] m32r: fix m32104ut_defconfig build fail Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 45/54] dma-debug: switch check from _text to _stext Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 46/54] scripts/bloat-o-meter: fix python3 syntax error Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 47/54] memcg: only free spare array when readers are done Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 48/54] radix-tree: fix race in gang lookup Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 49/54] radix-tree: fix oops after radix_tree_iter_retry Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 50/54] intel_scu_ipcutil: underflow in scu_reg_access() Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 51/54] x86/asm/irq: Stop relying on magic JMP behavior for early_idt_handlers Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 52/54] futex: Drop refcount if requeue_pi() acquired the rtmutex Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 53/54] ip6mr: call del_timer_sync() in ip6mr_free_table() Greg Kroah-Hartman
2016-02-24 3:34 ` [PATCH 3.10 54/54] module: wrapper for symbol name Greg Kroah-Hartman
2016-02-24 16:31 ` [PATCH 3.10 00/54] 3.10.98-stable review Willy Tarreau
2016-02-25 18:37 ` Greg Kroah-Hartman
2016-02-24 18:29 ` Shuah Khan
2016-02-25 4:57 ` Guenter Roeck
2016-02-25 16:33 ` Greg Kroah-Hartman
2016-02-25 17:01 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160224033353.834213590@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linus.walleij@linaro.org \
--cc=linux-clk@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pawel.moll@arm.com \
--cc=rmk+kernel@arm.linux.org.uk \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox