diff mbox series

[8/8,SRU,OEM-5.6] thunderbolt: Ensure left shift of 512 does not overflow a 32 bit int

Message ID 20200910032505.10882-9-koba.ko@canonical.com
State New
Headers show
Series [1/8,SRU,OEM-5.6] thunderbolt: Add support for separating the flush to SPI and authenticate | expand

Commit Message

Koba Ko Sept. 10, 2020, 3:25 a.m. UTC 
From: Colin Ian King <colin.king@canonical.com>

BugLink: https://bugs.launchpad.net/bugs/1895073

The 32 bit int value 512 is being left shifted and then used in a context
that expects the expression to be a larger unsigned long. There may be
a potential integer overflow, so make 512 a UL before shift to avoid
any such issues.

Addresses-Coverity: ("Uninintentional integer overflow")
Fixes: 3b1d8d577ca8 ("thunderbolt: Implement USB3 bandwidth negotiation routines")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
(cherry picked from commit 4c767ce48cf858971545164c4c53d028e6241c07)
Signed-off-by: Koba Ko <koba.ko@canonical.com>
---
 drivers/thunderbolt/usb4.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Koba Ko Sept. 16, 2020, 2:26 a.m. UTC | #1 
On Thu, Sep 10, 2020 at 11:25 AM Koba Ko <koba.ko@canonical.com> wrote:
>
> From: Colin Ian King <colin.king@canonical.com>
>
> BugLink: https://bugs.launchpad.net/bugs/1895073
>
> The 32 bit int value 512 is being left shifted and then used in a context
> that expects the expression to be a larger unsigned long. There may be
> a potential integer overflow, so make 512 a UL before shift to avoid
> any such issues.
>
> Addresses-Coverity: ("Uninintentional integer overflow")
> Fixes: 3b1d8d577ca8 ("thunderbolt: Implement USB3 bandwidth negotiation routines")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
> (cherry picked from commit 4c767ce48cf858971545164c4c53d028e6241c07)
> Signed-off-by: Koba Ko <koba.ko@canonical.com>
> ---
>  drivers/thunderbolt/usb4.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c
> index 5c8b3b95ce12..997a86a68cb2 100644
> --- a/drivers/thunderbolt/usb4.c
> +++ b/drivers/thunderbolt/usb4.c
> @@ -1349,7 +1349,7 @@ static unsigned int usb3_bw_to_mbps(u32 bw, u8 scale)
>  {
>         unsigned long uframes;
>
> -       uframes = bw * 512 << scale;
> +       uframes = bw * 512UL << scale;
>         return DIV_ROUND_CLOSEST(uframes * 8000, 1000 * 1000);
>  }
>
> @@ -1359,7 +1359,7 @@ static u32 mbps_to_usb3_bw(unsigned int mbps, u8 scale)
>
>         /* 1 uframe is 1/8 ms (125 us) -> 1 / 8000 s */
>         uframes = ((unsigned long)mbps * 1000 *  1000) / 8000;
> -       return DIV_ROUND_UP(uframes, 512 << scale);
> +       return DIV_ROUND_UP(uframes, 512UL << scale);
>  }
>
>  static int usb4_usb3_port_read_allocated_bandwidth(struct tb_port *port,
> --
> 2.25.1
>
diff mbox series

Patch

diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c
index 5c8b3b95ce12..997a86a68cb2 100644
--- a/drivers/thunderbolt/usb4.c
+++ b/drivers/thunderbolt/usb4.c
@@ -1349,7 +1349,7 @@  static unsigned int usb3_bw_to_mbps(u32 bw, u8 scale)
 {
 	unsigned long uframes;
 
-	uframes = bw * 512 << scale;
+	uframes = bw * 512UL << scale;
 	return DIV_ROUND_CLOSEST(uframes * 8000, 1000 * 1000);
 }
 
@@ -1359,7 +1359,7 @@  static u32 mbps_to_usb3_bw(unsigned int mbps, u8 scale)
 
 	/* 1 uframe is 1/8 ms (125 us) -> 1 / 8000 s */
 	uframes = ((unsigned long)mbps * 1000 *  1000) / 8000;
-	return DIV_ROUND_UP(uframes, 512 << scale);
+	return DIV_ROUND_UP(uframes, 512UL << scale);
 }
 
 static int usb4_usb3_port_read_allocated_bandwidth(struct tb_port *port,