From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDD6D155389; Tue, 9 Jul 2024 11:12:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720523576; cv=none; b=IgnllyCCFYByzsLBI1rqTOjSc13P7XvsXlBOqoiRBZlvILbmzTuTwr7FLDwextMYIyjTjNyeRRij+AvOVZWtxNm9BnMMLQqOm/vO3OlZBfM55hHTHaokKkfd/aRjpl/o9GRXGPDITszKyfhtxNNYkVSHjop+Ww+au/stBvGNxSg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720523576; c=relaxed/simple; bh=UA7LRbCmBQwJv0nwL9LFG7KFT/9oxezAWFiP5LpMFtw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RL9DNuyGDol2l7+SKC2PxdFxTcAIuxrgeJww4AHUT7oWO4yDZhBP0OcLd/jVTlltGFJqMvz6XRDKTBzKce7TvEOLIPJdRZhWacW1vWTTqKRIWg5hP74K6lu0gSCevZY2xzJIpEAHkl94i+yzZZ+Vl8+BThk4M27pMofW+UG36so= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PMWf6SnE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="PMWf6SnE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 696BEC3277B; Tue, 9 Jul 2024 11:12:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1720523575; bh=UA7LRbCmBQwJv0nwL9LFG7KFT/9oxezAWFiP5LpMFtw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PMWf6SnE8yLueXa4rEMwSBDXs4XGO9IKmtsi5uoEu8/RSTp46fMnGGzJ3VKaV4bOt SeM00wZFbLh9h8KhU+s3k0xRvxvS4i2YSVDoaJNysBP/mvKD6nBNbzN77x9HOZf0aI vHU1Eosux3dgxXfFbHgCc/6JPcVMSuEMwWoifq1c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Dan Carpenter , Ricardo Ribalda , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 6.6 038/139] media: dvb-frontends: tda10048: Fix integer overflow Date: Tue, 9 Jul 2024 13:08:58 +0200 Message-ID: <20240709110659.637679705@linuxfoundation.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240709110658.146853929@linuxfoundation.org> References: <20240709110658.146853929@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ricardo Ribalda [ Upstream commit 1aa1329a67cc214c3b7bd2a14d1301a795760b07 ] state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 64 bit variable to hold the calculations. Link: https://lore.kernel.org/linux-media/20240429-fix-cocci-v3-25-3c4865f5a4b0@chromium.org Reported-by: Dan Carpenter Signed-off-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/dvb-frontends/tda10048.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/media/dvb-frontends/tda10048.c b/drivers/media/dvb-frontends/tda10048.c index 5d5e4e9e4422e..3e725cdcc66bd 100644 --- a/drivers/media/dvb-frontends/tda10048.c +++ b/drivers/media/dvb-frontends/tda10048.c @@ -410,6 +410,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) struct tda10048_config *config = &state->config; int i; u32 if_freq_khz; + u64 sample_freq; dprintk(1, "%s(bw = %d)\n", __func__, bw); @@ -451,9 +452,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor); /* Calculate the sample frequency */ - state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45); - state->sample_freq /= (state->pll_nfactor + 1); - state->sample_freq /= (state->pll_pfactor + 4); + sample_freq = state->xtal_hz; + sample_freq *= state->pll_mfactor + 45; + do_div(sample_freq, state->pll_nfactor + 1); + do_div(sample_freq, state->pll_pfactor + 4); + state->sample_freq = sample_freq; dprintk(1, "- sample_freq = %d\n", state->sample_freq); /* Update the I/F */ -- 2.43.0