From 1e5ce6e10a1deaec6044ba8ad75431e0424dbce9 Mon Sep 17 00:00:00 2001 From: Hao Wu Date: Tue, 26 Jan 2021 17:11:42 -0800 Subject: hw/misc: Fix arith overflow in NPCM7XX PWM module Fix potential overflow problem when calculating pwm_duty. 1. Ensure p->cmr and p->cnr to be from [0,65535], according to the hardware specification. 2. Changed duty to uint32_t. However, since MAX_DUTY * (p->cmr+1) can excceed UINT32_MAX, we convert them to uint64_t in computation and converted them back to uint32_t. (duty is guaranteed to be <= MAX_DUTY so it won't overflow.) Fixes: CID 1442342 Suggested-by: Peter Maydell Reviewed-by: Doug Evans Signed-off-by: Hao Wu Message-id: 20210127011142.2122790-1-wuhaotsh@google.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- tests/qtest/npcm7xx_pwm-test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'tests/qtest/npcm7xx_pwm-test.c') diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c index 63557d2c..3d82654 100644 --- a/tests/qtest/npcm7xx_pwm-test.c +++ b/tests/qtest/npcm7xx_pwm-test.c @@ -272,7 +272,7 @@ static uint64_t pwm_compute_freq(QTestState *qts, uint32_t ppr, uint32_t csr, static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted) { - uint64_t duty; + uint32_t duty; if (cnr == 0) { /* PWM is stopped. */ @@ -280,7 +280,7 @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted) } else if (cmr >= cnr) { duty = MAX_DUTY; } else { - duty = MAX_DUTY * (cmr + 1) / (cnr + 1); + duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1); } if (inverted) { -- cgit v1.1