From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753270AbdBTMk1 convert rfc822-to-8bit (ORCPT ); Mon, 20 Feb 2017 07:40:27 -0500 Received: from smtp-out4.electric.net ([192.162.216.187]:65464 "EHLO smtp-out4.electric.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753204AbdBTMkZ (ORCPT ); Mon, 20 Feb 2017 07:40:25 -0500 From: David Laight To: "'Gustavo A. R. Silva'" , "mathias.nyman@intel.com" , "gregkh@linuxfoundation.org" CC: "linux-usb@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "Peter Senna Tschudin" Subject: RE: [PATCH] usb: host: add cast to avoid potential integer overflow Thread-Topic: [PATCH] usb: host: add cast to avoid potential integer overflow Thread-Index: AQHSiLMmfX+1XrbgmECs4+8RlPaeYKFx2gxw Date: Mon, 20 Feb 2017 12:40:11 +0000 Message-ID: <063D6719AE5E284EB5DD2968C1650D6DCFE6B7D4@AcuExch.aculab.com> References: <20170217001640.GA9137@embeddedgus> In-Reply-To: <20170217001640.GA9137@embeddedgus> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.202.99.200] Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 X-Outbound-IP: 213.249.233.130 X-Env-From: David.Laight@ACULAB.COM X-Proto: esmtps X-Revdns: X-HELO: AcuExch.aculab.com X-TLS: TLSv1:AES128-SHA:128 X-Authenticated_ID: X-PolicySMART: 3396946, 3397078 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Gustavo A. R. Silva > Sent: 17 February 2017 00:17 > The type of variable 'sel' is unsigned int. Such variable is being used > multiple times in a context that expects an expression of type unsigned > long long. So, to avoid any potential integer overflow, a cast to type > unsigned long long is added. ... > - timeout_ns = udev->u1_params.sel * 3; > + timeout_ns = (unsigned long long)udev->u1_params.sel * 3; ... It is probably better to just change the constant to 3ull. However I'd be tempted to look more closely at the valid values for 'timeout_ns'. It seems unlikely that that the timeout (in sel) will be near enough to 4 seconds that multiplying by a small integer will take the value over 4 seconds without requiring larger input values be supported. timeout_ns might even be being used in places where the value has to be smaller than 1 second! David