PM: domains: fix integer overflow issues in genpd_parse_state()

Message ID 20230418130743.67024-1-n.zhandarovich@fintech.ru
State New
Headers
Series PM: domains: fix integer overflow issues in genpd_parse_state() |

Commit Message

Nikita Zhandarovich April 18, 2023, 1:07 p.m. UTC
  Currently, while calculating residency and latency values, right
operands may overflow if resulting values are big enough.

To prevent this, albeit unlikely case, play it safe and convert
right operands to left ones' type s64.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 30f604283e05 ("PM / Domains: Allow domain power states to be read from DT")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
---
 drivers/base/power/domain.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
  

Comments

Ulf Hansson May 8, 2023, 10:36 a.m. UTC | #1
On Tue, 18 Apr 2023 at 15:07, Nikita Zhandarovich
<n.zhandarovich@fintech.ru> wrote:
>
> Currently, while calculating residency and latency values, right
> operands may overflow if resulting values are big enough.
>
> To prevent this, albeit unlikely case, play it safe and convert
> right operands to left ones' type s64.
>
> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
>
> Fixes: 30f604283e05 ("PM / Domains: Allow domain power states to be read from DT")
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>

Acked-by: Ulf Hansson <ulf.hansson@linaro.org>

Kind regards
Uffe

> ---
>  drivers/base/power/domain.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
> index 32084e38b73d..51b9d4eaab5e 100644
> --- a/drivers/base/power/domain.c
> +++ b/drivers/base/power/domain.c
> @@ -2939,10 +2939,10 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state,
>
>         err = of_property_read_u32(state_node, "min-residency-us", &residency);
>         if (!err)
> -               genpd_state->residency_ns = 1000 * residency;
> +               genpd_state->residency_ns = 1000LL * residency;
>
> -       genpd_state->power_on_latency_ns = 1000 * exit_latency;
> -       genpd_state->power_off_latency_ns = 1000 * entry_latency;
> +       genpd_state->power_on_latency_ns = 1000LL * exit_latency;
> +       genpd_state->power_off_latency_ns = 1000LL * entry_latency;
>         genpd_state->fwnode = &state_node->fwnode;
>
>         return 0;
> --
> 2.25.1
>
  
Rafael J. Wysocki May 24, 2023, 4:38 p.m. UTC | #2
On Mon, May 8, 2023 at 12:37 PM Ulf Hansson <ulf.hansson@linaro.org> wrote:
>
> On Tue, 18 Apr 2023 at 15:07, Nikita Zhandarovich
> <n.zhandarovich@fintech.ru> wrote:
> >
> > Currently, while calculating residency and latency values, right
> > operands may overflow if resulting values are big enough.
> >
> > To prevent this, albeit unlikely case, play it safe and convert
> > right operands to left ones' type s64.
> >
> > Found by Linux Verification Center (linuxtesting.org) with static
> > analysis tool SVACE.
> >
> > Fixes: 30f604283e05 ("PM / Domains: Allow domain power states to be read from DT")
> > Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
>
> Acked-by: Ulf Hansson <ulf.hansson@linaro.org>

Applied as 6.5 material, thanks!

And sorry for the delay.
  

Patch

diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 32084e38b73d..51b9d4eaab5e 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -2939,10 +2939,10 @@  static int genpd_parse_state(struct genpd_power_state *genpd_state,
 
 	err = of_property_read_u32(state_node, "min-residency-us", &residency);
 	if (!err)
-		genpd_state->residency_ns = 1000 * residency;
+		genpd_state->residency_ns = 1000LL * residency;
 
-	genpd_state->power_on_latency_ns = 1000 * exit_latency;
-	genpd_state->power_off_latency_ns = 1000 * entry_latency;
+	genpd_state->power_on_latency_ns = 1000LL * exit_latency;
+	genpd_state->power_off_latency_ns = 1000LL * entry_latency;
 	genpd_state->fwnode = &state_node->fwnode;
 
 	return 0;