This is a note to let you know that I've just added the patch titled
clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate()
to the 6.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
clk-sophgo-avoid-integer-overflow-in-sg2042_pll_reca.patch
and it can be found in the queue-6.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 1d5156b6ae8aa039e7d4b1505a4d77b6b30c3ef8
Author: Zichen Xie <zichenxie0106@xxxxxxxxx>
Date: Wed Oct 23 09:51:47 2024 -0500
clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate()
[ Upstream commit 00f8f70a0e8c6601861628be26270a0b6f4bbb34 ]
This was found by a static analyzer.
There may be a potential integer overflow issue in
sg2042_pll_recalc_rate(). numerator is defined as u64 while
parent_rate is defined as unsigned long and ctrl_table.fbdiv
is defined as unsigned int. On 32-bit machine, the result of
the calculation will be limited to "u32" without correct casting.
Integer overflow may occur on high-performance systems.
Fixes: 48cf7e01386e ("clk: sophgo: Add SG2042 clock driver")
Signed-off-by: Zichen Xie <zichenxie0106@xxxxxxxxx>
Reviewed-by: Chen Wang <unicorn_wang@xxxxxxxxxxx>
Link: https://lore.kernel.org/r/20241023145146.13130-1-zichenxie0106@xxxxxxxxx
Reviewed-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Stephen Boyd <sboyd@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/clk/sophgo/clk-sg2042-pll.c b/drivers/clk/sophgo/clk-sg2042-pll.c
index ff9deeef509b8..1537f4f05860e 100644
--- a/drivers/clk/sophgo/clk-sg2042-pll.c
+++ b/drivers/clk/sophgo/clk-sg2042-pll.c
@@ -153,7 +153,7 @@ static unsigned long sg2042_pll_recalc_rate(unsigned int reg_value,
sg2042_pll_ctrl_decode(reg_value, &ctrl_table);
- numerator = parent_rate * ctrl_table.fbdiv;
+ numerator = (u64)parent_rate * ctrl_table.fbdiv;
denominator = ctrl_table.refdiv * ctrl_table.postdiv1 * ctrl_table.postdiv2;
do_div(numerator, denominator);
return numerator;
