linux-kernel - [PATCH] mmc: dw_mmc: Fix the DTO timeout overflow calculation for 32-bit systems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Feb 2018 20:57:33 +0300
From:   Evgeniy Didin <Evgeniy.Didin@...opsys.com>
To:     linux-mmc@...r.kernel.org
Cc:     Evgeniy Didin <Evgeniy.Didin@...opsys.com>,
        Alexey Brodkin <Alexey.Brodkin@...opsys.com>,
        Douglas Anderson <dianders@...omium.org>,
        Ulf Hansson <ulf.hansson@...aro.org>,
        linux-kernel@...r.kernel.org, linux-snps-arc@...ts.infradead.org
Subject: [PATCH] mmc: dw_mmc: Fix the DTO timeout overflow calculation for 32-bit systems

In commit 9d9491a7da2a ("mmc: dw_mmc: Fix the DTO timeout calculation") have been made
changes which can cause multiply overflow for 32-bit systems. It was caught on arc/hsdk board
when "drto_ms" should be 671, but it was 70 and that caused a flow of stack-traces just copying
file from mmc.

Lets cast this multiply to long long int which prevents overflow.

Signed-off-by: Evgeniy Didin <Evgeniy.Didin@...opsys.com>
CC: Alexey Brodkin <abrodkin@...opsys.com>
CC: Douglas Anderson <dianders@...omium.org>
CC: Ulf Hansson <ulf.hansson@...aro.org>
CC: linux-kernel@...r.kernel.org
CC: linux-snps-arc@...ts.infradead.org
---
 drivers/mmc/host/dw_mmc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 0aa39975f33b..1a0b9751c67c 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1944,7 +1944,7 @@ static void dw_mci_set_drto(struct dw_mci *host)
 	drto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
 	if (drto_div == 0)
 		drto_div = 1;
-	drto_ms = DIV_ROUND_UP(MSEC_PER_SEC * drto_clks * drto_div,
+	drto_ms = DIV_ROUND_UP((uint64_t)MSEC_PER_SEC * drto_clks * drto_div,
 			       host->bus_hz);
 
 	/* add a bit spare time */
-- 
2.11.0