Skip to content

Commit

Permalink
power: supply: da9150-fg: fix potential overflow
Browse files Browse the repository at this point in the history
Size of variable sd_gain equals four bytes - DA9150_QIF_SD_GAIN_SIZE.
Size of variable shunt_val equals two bytes - DA9150_QIF_SHUNT_VAL_SIZE.

The expression sd_gain * shunt_val is currently being evaluated using
32-bit arithmetic. So during the multiplication an overflow may occur.

As the value of type 'u64' is used as storage for the eventual result, put
ULL variable at the first position of each expression in order to give the
compiler complete information about the proper arithmetic to use. According
to C99 the guaranteed width for a variable of type 'unsigned long long' >=
64 bits.

Remove the explicit cast to u64 as it is meaningless.

Just for the sake of consistency, perform the similar trick with another
expression concerning 'iavg'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a419b4f ("power: Add support for DA9150 Fuel-Gauge")
Signed-off-by: Andrey Vatoropin <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sebastian Reichel <[email protected]>
  • Loading branch information
Andrey Vatoropin authored and sre committed Feb 3, 2025
1 parent 2014c95 commit 3fb3cb4
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions drivers/power/supply/da9150-fg.c
Original file line number Diff line number Diff line change
Expand Up @@ -247,9 +247,9 @@ static int da9150_fg_current_avg(struct da9150_fg *fg,
DA9150_QIF_SD_GAIN_SIZE);
da9150_fg_read_sync_end(fg);

div = (u64) (sd_gain * shunt_val * 65536ULL);
div = 65536ULL * sd_gain * shunt_val;
do_div(div, 1000000);
res = (u64) (iavg * 1000000ULL);
res = 1000000ULL * iavg;
do_div(res, div);

val->intval = (int) res;
Expand Down

0 comments on commit 3fb3cb4

Please sign in to comment.