[PATCH] pwm: ipq: prevent potential 32-bit integer overflow in hi_div calculation
[email protected] Fri, 24 Jul 2026 10:18:54 +0530
| Newsgroups | org.kernel.vger.linux-pwm,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
From: Surendra Singh Chouhan <[email protected]> In ipq_pwm_get_state(), hi_div was calculated as: hi_div = hi_dur * (pre_div + 1); hi_dur and (pre_div + 1) are both unsigned int (32-bit) values. Evaluating their multiplication using 32-bit arithmetic before assigning to the 64-bit u64 hi_div variable can overflow 32-bit unsigned math. While effective_div explicitly uses (u64)(pwm_div + 1) * (pre_div + 1) to prevent overflow, hi_div was missing the (u64) cast. Fix this by casting hi_dur to (u64) before multiplication, matching the precision used for effective_div. Fixes: c436e3e9c265 ("pwm: Driver for qualcomm ipq6018 pwm block") Signed-off-by: Surendra Singh Chouhan <[email protected]> --- drivers/pwm/pwm-ipq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pwm/pwm-ipq.c b/drivers/pwm/pwm-ipq.c index c53373948136..e27ddc8e9fea 100644 --- a/drivers/pwm/pwm-ipq.c +++ b/drivers/pwm/pwm-ipq.c @@ -186,7 +186,7 @@ static int ipq_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm, state->period = DIV64_U64_ROUND_UP(effective_div * NSEC_PER_SEC, ipq_chip->clk_rate); - hi_div = hi_dur * (pre_div + 1); + hi_div = (u64)hi_dur * (pre_div + 1); state->duty_cycle = DIV64_U64_ROUND_UP(hi_div * NSEC_PER_SEC, ipq_chip->clk_rate); -- 2.55.0