From patchwork Wed Feb 22 06:33:48 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: David Gibson X-Patchwork-Id: 94292 Delivered-To: patch@linaro.org Received: by 10.182.3.34 with SMTP id 2csp830631obz; Tue, 21 Feb 2017 23:04:17 -0800 (PST) X-Received: by 10.55.39.147 with SMTP id n141mr13876036qkn.103.1487747057631; Tue, 21 Feb 2017 23:04:17 -0800 (PST) Return-Path: Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id m99si246111qkh.302.2017.02.21.23.04.17 for (version=TLS1 cipher=AES128-SHA bits=128/128); Tue, 21 Feb 2017 23:04:17 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gibson.dropbear.id.au; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom=qemu-devel-bounces+patch=linaro.org@nongnu.org Received: from localhost ([::1]:50285 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cgQyF-0005rt-6K for patch@linaro.org; Wed, 22 Feb 2017 02:04:15 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38212) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cgQVF-0003Ck-Dg for qemu-devel@nongnu.org; Wed, 22 Feb 2017 01:34:20 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cgQVC-0008F6-Mv for qemu-devel@nongnu.org; Wed, 22 Feb 2017 01:34:17 -0500 Received: from ozlabs.org ([103.22.144.67]:46153) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cgQVC-0008Cp-81; Wed, 22 Feb 2017 01:34:14 -0500 Received: by ozlabs.org (Postfix, from userid 1007) id 3vSndM5hW1z9sND; Wed, 22 Feb 2017 17:33:58 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gibson.dropbear.id.au; s=201602; t=1487745239; bh=KfGvTpjmUx0kKbHaoVnH+h4ONnqLSCAMUpVIsZpnbB8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dN8zgvqaXiSvIe3AlrLttqlEjukYFi3kgAuCqFQGw/lllsR9MAojmMMozyaQ6ib/X EjQ9yUVRoVMsFfNlarT/qy5zCkSqKHC3mtuBKiXVFgma2U+PVmB3eejVjkARi9583z GWcouDRjK1hja8oI2yLHKGBkYA49ldI9anCFnFR0= From: David Gibson To: peter.maydell@linaro.org Date: Wed, 22 Feb 2017 17:33:48 +1100 Message-Id: <20170222063348.32176-44-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170222063348.32176-1-david@gibson.dropbear.id.au> References: <20170222063348.32176-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 103.22.144.67 Subject: [Qemu-devel] [PULL 43/43] hw/ppc/ppc405_uc.c: Avoid integer overflows X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: lvivier@redhat.com, thuth@redhat.com, qemu-devel@nongnu.org, mdroth@linux.vnet.ibm.com, agraf@suse.de, qemu-ppc@nongnu.org, imammedo@redhat.com, David Gibson Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" From: Peter Maydell When performing clock calculations, the ppc405_uc code has several places where it multiplies together two 32-bit variables and assigns the result to a 64-bit variable. This doesn't quite do what is intended because C will compute a 32-bit multiply result. Add casts to ensure we don't truncate the result. (Spotted by Coverity, CID 1005504, 1005505.) Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: David Gibson --- hw/ppc/ppc405_uc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.9.3 diff --git a/hw/ppc/ppc405_uc.c b/hw/ppc/ppc405_uc.c index d6d3fc2..d5df94a 100644 --- a/hw/ppc/ppc405_uc.c +++ b/hw/ppc/ppc405_uc.c @@ -1881,7 +1881,7 @@ static void ppc405cr_clk_setup (ppc405cr_cpc_t *cpc) D1 = (((cpc->pllmr >> 20) - 1) & 0xF) + 1; /* FBDV */ D2 = 8 - ((cpc->pllmr >> 16) & 0x7); /* FWDVA */ M = D0 * D1 * D2; - VCO_out = cpc->sysclk * M; + VCO_out = (uint64_t)cpc->sysclk * M; if (VCO_out < 400000000 || VCO_out > 800000000) { /* PLL cannot lock */ cpc->pllmr &= ~0x80000000; @@ -1892,7 +1892,7 @@ static void ppc405cr_clk_setup (ppc405cr_cpc_t *cpc) /* Bypass PLL */ bypass_pll: M = D0; - PLL_out = cpc->sysclk * M; + PLL_out = (uint64_t)cpc->sysclk * M; } CPU_clk = PLL_out; if (cpc->cr1 & 0x00800000) @@ -2242,7 +2242,7 @@ static void ppc405ep_compute_clocks (ppc405ep_cpc_t *cpc) #ifdef DEBUG_CLOCKS_LL printf("FWDA %01" PRIx32 " %d\n", (cpc->pllmr[1] >> 16) & 0x7, D); #endif - VCO_out = cpc->sysclk * M * D; + VCO_out = (uint64_t)cpc->sysclk * M * D; if (VCO_out < 500000000UL || VCO_out > 1000000000UL) { /* Error - unlock the PLL */ printf("VCO out of range %" PRIu64 "\n", VCO_out);