Re: [PATCH v2 2/6] drm: Add drm_timeout_rel_to_jiffies()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Inadequate overflow check in `drm_timeout_rel_to_jiffies` allows `nsecs_to_jiffies64` to wrap around for large timeouts on 64-bit systems.
--

--- Patch [2]: [PATCH v2 2/6] drm: Add drm_timeout_rel_to_jiffies() ---
commit 8056b58ff81363ebaf4bcf9d659c346706fc5b99
Author: Maíra Canal <[email protected]>

drm: Add drm_timeout_rel_to_jiffies()

This commit introduces a core helper to convert a relative timeout in
nanoseconds to jiffies. It aims to unify similar conversions currently done
in drivers like i915 and v3d.

> diff --git a/drivers/gpu/drm/drm_timeout.c b/drivers/gpu/drm/drm_timeout.c
> index 78e9f65e54779..18c2719d1fe92 100644
> --- a/drivers/gpu/drm/drm_timeout.c
> +++ b/drivers/gpu/drm/drm_timeout.c
[ ... ]
> @@ -45,3 +46,36 @@ signed long drm_timeout_abs_to_jiffies(int64_t timeout_nsec)
>  	return timeout_jiffies64 + 1;
>  }
>  EXPORT_SYMBOL(drm_timeout_abs_to_jiffies);
> +
> +/**
> + * drm_timeout_rel_to_jiffies - calculate jiffies timeout from relative value
[ ... ]
> +unsigned long drm_timeout_rel_to_jiffies(u64 timeout_nsec)
> +{
> +	/* make 0 timeout means poll, as for the absolute variant */
> +	if (timeout_nsec == 0)
> +		return 0;
> +
> +	/* nsecs_to_jiffies64() does not guard against overflow */
> +	if ((NSEC_PER_SEC % HZ) != 0 &&
> +	    div_u64(timeout_nsec, NSEC_PER_SEC) >= MAX_JIFFY_OFFSET / HZ)
> +		return MAX_JIFFY_OFFSET;

[Severity: Medium]
Is it possible this overflow guard is ineffective on 64-bit systems? 

Since MAX_JIFFY_OFFSET is extremely large on 64-bit architectures, and
nsecs_to_jiffies64() internally uses a multiplication that can overflow a u64
at roughly 65 years, a very large timeout_nsec might bypass this check. 

If it bypasses this check, the value could still wrap around during the
nsecs_to_jiffies64() conversion, causing the wait to return almost
immediately instead of blocking as requested.

> +
> +	return min_t(u64, MAX_JIFFY_OFFSET, nsecs_to_jiffies64(timeout_nsec) + 1);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2