Skip to content

Commit 3fb3cb4

Browse files
Andrey Vatoropinsre
authored andcommitted
power: supply: da9150-fg: fix potential overflow
Size of variable sd_gain equals four bytes - DA9150_QIF_SD_GAIN_SIZE. Size of variable shunt_val equals two bytes - DA9150_QIF_SHUNT_VAL_SIZE. The expression sd_gain * shunt_val is currently being evaluated using 32-bit arithmetic. So during the multiplication an overflow may occur. As the value of type 'u64' is used as storage for the eventual result, put ULL variable at the first position of each expression in order to give the compiler complete information about the proper arithmetic to use. According to C99 the guaranteed width for a variable of type 'unsigned long long' >= 64 bits. Remove the explicit cast to u64 as it is meaningless. Just for the sake of consistency, perform the similar trick with another expression concerning 'iavg'. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: a419b4f ("power: Add support for DA9150 Fuel-Gauge") Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru> Link: https://lore.kernel.org/r/20250130090030.53422-1-a.vatoropin@crpt.ru Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
1 parent 2014c95 commit 3fb3cb4

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/power/supply/da9150-fg.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -247,9 +247,9 @@ static int da9150_fg_current_avg(struct da9150_fg *fg,
247247
DA9150_QIF_SD_GAIN_SIZE);
248248
da9150_fg_read_sync_end(fg);
249249

250-
div = (u64) (sd_gain * shunt_val * 65536ULL);
250+
div = 65536ULL * sd_gain * shunt_val;
251251
do_div(div, 1000000);
252-
res = (u64) (iavg * 1000000ULL);
252+
res = 1000000ULL * iavg;
253253
do_div(res, div);
254254

255255
val->intval = (int) res;

0 commit comments

Comments
 (0)