linux-kernel - [PATCH] tty: serial: fsl_lpuart: Fix possible integer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230718065645.6588-1-sherry.sun@nxp.com>
Date:   Tue, 18 Jul 2023 14:56:45 +0800
From:   Sherry Sun <sherry.sun@....com>
To:     gregkh@...uxfoundation.org, jirislaby@...nel.org,
        ilpo.jarvinen@...ux.intel.com, shenwei.wang@....com
Cc:     linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-imx@....com
Subject: [PATCH] tty: serial: fsl_lpuart: Fix possible integer overflow

This patch addresses the following Coverity report, fix it by casting
sport->port.frame_time to type u64.

CID 32305660: Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
Potentially overflowing expression sport->port.frame_time * 8U with type
unsigned int (32 bits, unsigned) is evaluated using 32-bit arithmetic,
and then used in a context that expects an expression of type u64 (64
bits, unsigned).

Fixes: cf9aa72d2f91 ("tty: serial: fsl_lpuart: optimize the timer based EOP logic")
Signed-off-by: Sherry Sun <sherry.sun@....com>
---
 drivers/tty/serial/fsl_lpuart.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index c1980ea52666..07b3b26732db 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1373,7 +1373,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
 
 	sport->last_residue = 0;
 	sport->dma_rx_timeout = max(nsecs_to_jiffies(
-		sport->port.frame_time * DMA_RX_IDLE_CHARS), 1UL);
+		(u64)sport->port.frame_time * DMA_RX_IDLE_CHARS), 1UL);
 
 	ring->buf = kzalloc(sport->rx_dma_rng_buf_len, GFP_ATOMIC);
 	if (!ring->buf)
-- 
2.17.1