From: Cosmin Tanislav Date: Fri, 13 Jun 2025 11:21:53 +0000 (+0300) Subject: media: rc: ir-spi: avoid overflow in multiplication X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c0b1da281d84d33281fc49289f0c7f8aada450ff;p=thirdparty%2Flinux.git media: rc: ir-spi: avoid overflow in multiplication Switch to u64 arithmetic and use DIV_ROUND_CLOSEST_ULL() to avoid the overflow. buffer[i] is unsigned int and is limited by the lirc core to IR_MAX_DURATION, which is 500000. idata->freq is u32, which has a max value of 0xFFFFFFFF. In the case where buffer[i] is 500000, idata->freq overflows the u32 multiplication for any values >= 8590. 0xFFFFFFFF / 500000 ~= 8589 By casting buffer[i] to u64, idata->freq can be any u32 value without overflowing the multiplication. 0xFFFFFFFFFFFFFFFF / 500000 ~= 36893488147419 (> 4294967295) The result of the final operation will fit back into the unsigned int limits without any issues. 500000 * 0xFFFFFFFF / 1000000 = 0x80000000 (< 0xFFFFFFFF) Signed-off-by: Cosmin Tanislav Signed-off-by: Sean Young Signed-off-by: Hans Verkuil --- diff --git a/drivers/media/rc/ir-spi.c b/drivers/media/rc/ir-spi.c index 0b54ad74cec08..392441e0c1164 100644 --- a/drivers/media/rc/ir-spi.c +++ b/drivers/media/rc/ir-spi.c @@ -46,7 +46,8 @@ static int ir_spi_tx(struct rc_dev *dev, unsigned int *buffer, unsigned int coun /* convert the pulse/space signal to raw binary signal */ for (i = 0; i < count; i++) { - buffer[i] = DIV_ROUND_CLOSEST(buffer[i] * idata->freq, 1000000); + buffer[i] = DIV_ROUND_CLOSEST_ULL((u64)buffer[i] * idata->freq, + 1000000); len += buffer[i]; }