Commit 8729272d authored by Colin Ian King's avatar Colin Ian King Committed by Kleber Sacilotto de Souza

atm: he: fix sign-extension overflow on large shift

BugLink: https://bugs.launchpad.net/bugs/1822271

[ Upstream commit cb12d72b ]

Shifting the 1 by exp by an int can lead to sign-extension overlow when
exp is 31 since 1 is an signed int and sign-extending this result to an
unsigned long long will set the upper 32 bits.  Fix this by shifting an
unsigned long.

Detected by cppcheck:
(warning) Shifting signed 32-bit value by 31 bits is undefined behaviour
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarStefan Bader <stefan.bader@canonical.com>
Acked-by: default avatarJuerg Haefliger <juerg.haefliger@canonical.com>
Signed-off-by: default avatarKleber Sacilotto de Souza <kleber.souza@canonical.com>
parent 2bd82dcd
...@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev) ...@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)
instead of '/ 512', use '>> 9' to prevent a call instead of '/ 512', use '>> 9' to prevent a call
to divdu3 on x86 platforms to divdu3 on x86 platforms
*/ */
rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9; rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9;
if (rate_cps < 10) if (rate_cps < 10)
rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */ rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment