From d0076c906a96019c0fe12be78e5ab21eaf15e69e Mon Sep 17 00:00:00 2001 From: qihao_yewu Date: Mon, 25 Nov 2024 04:48:16 -0500 Subject: [PATCH] hw/timer/exynos4210_mct: fix possible int overflow cheery-pick from c5d36da7ec62e4c72a72a437057fb6072cf0d6ab The product "icnto * s->tcntb" may overflow uint32_t. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Frolov Message-id: 20241106083801.219578-2-frolov@swemel.ru Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell Signed-off-by: qihao_yewu --- hw/timer/exynos4210_mct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c index 446bbd2b96..6f47bfe2c2 100644 --- a/hw/timer/exynos4210_mct.c +++ b/hw/timer/exynos4210_mct.c @@ -815,7 +815,7 @@ static uint32_t exynos4210_ltick_cnt_get_cnto(struct tick_timer *s) /* Both are counting */ icnto = remain / s->tcntb; if (icnto) { - tcnto = remain % (icnto * s->tcntb); + tcnto = remain % ((uint64_t)icnto * s->tcntb); } else { tcnto = remain % s->tcntb; } -- Gitee