]> www.infradead.org Git - users/jedix/linux-maple.git/commit
media: rc: ir-spi: avoid overflow in multiplication
authorCosmin Tanislav <demonsingur@gmail.com>
Fri, 13 Jun 2025 11:21:53 +0000 (14:21 +0300)
committerHans Verkuil <hverkuil@xs4all.nl>
Mon, 23 Jun 2025 10:11:04 +0000 (12:11 +0200)
commitc0b1da281d84d33281fc49289f0c7f8aada450ff
tree32f753825180b5964eac960c798fd7162bd50d3f
parent032a68ccb7834b28d51c11bbfe1c2db02e65ad28
media: rc: ir-spi: avoid overflow in multiplication

Switch to u64 arithmetic and use DIV_ROUND_CLOSEST_ULL() to avoid
the overflow.

buffer[i] is unsigned int and is limited by the lirc core to
IR_MAX_DURATION, which is 500000.

idata->freq is u32, which has a max value of 0xFFFFFFFF.

In the case where buffer[i] is 500000, idata->freq overflows the u32
multiplication for any values >= 8590.

0xFFFFFFFF / 500000 ~= 8589

By casting buffer[i] to u64, idata->freq can be any u32 value without
overflowing the multiplication.

0xFFFFFFFFFFFFFFFF / 500000 ~= 36893488147419 (> 4294967295)

The result of the final operation will fit back into the unsigned int
limits without any issues.

500000 * 0xFFFFFFFF / 1000000 = 0x80000000 (< 0xFFFFFFFF)

Signed-off-by: Cosmin Tanislav <demonsingur@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
drivers/media/rc/ir-spi.c