From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f50.google.com (mail-qv1-f50.google.com [209.85.219.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2201BEADC for ; Tue, 9 Jun 2026 00:14:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780964056; cv=none; b=uU0GjIV/TjZIMgW9LmSbXnrnmJSs2Ki6mC2W+clFCYAtImesyB44XFn0XSGJG7ZYf5Fgv+poc84P1Tsk/944w1hM4SdiCLHUfU36nLA2x/VVgc7EQ7H3bWmQcgzNum6EIq3DuueJu9tgvTwU+q92UvI7EZ8hy51cj8wKmqDdB2M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780964056; c=relaxed/simple; bh=V4q8EOOLOe7KST8ZDSizBNTC9HkruBR7NoNr3VZt+2Q=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AMyKpxlNt25CS3lZJEduBIS1vghrF3YEmj830GshsbTis06xG+jJ96RN/Dr7yX8/5sD7k4gColfE+khMQXHB+as3VfO1osmlBvTTCK9VoQZvd9ANbYSySZVyx+EEM5di2tpZm8IuyYHGRYFAacszc6Bg4FonCJCgL5KbCJPljbM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=CPgHQi6g; arc=none smtp.client-ip=209.85.219.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="CPgHQi6g" Received: by mail-qv1-f50.google.com with SMTP id 6a1803df08f44-8ce9df4732cso51977606d6.1 for ; Mon, 08 Jun 2026 17:14:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1780964054; x=1781568854; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=BBpDLfFrzrXrgkByDpm77agDc34WRnQ1/tX/Rq37o7k=; b=CPgHQi6gbFiJ4aUB11UjPl3lLuZe1vt0cyEHTVrjXe6LDfqKEtHJ6gwcJVSPb94zeR ebp/dvAWOOi3Mh6FLP5pSkt/+Bz6jvrHPK9TUfsavh3VuCDUozSsNZBcj3+iEMiDjua0 2h34KPzBrREA/WyN1o8JZp3nyGJSPT/TpRLEEeuDQgvuOQIhXCUnxJ9kwD5TShlSy3jj qoCWNdOsEtnqahzwUSSN9b+3pb6qz6vC0C7XyLUix99O4hgUWZI5pi44kD5PohLmk902 vf+/c9JHMrRSVGe+9GwRClWVBJ1Zg5CZBBJNYHloPJcGYsXK1CzU3qtlKv/vlVXBjU0D B+hA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780964054; x=1781568854; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=BBpDLfFrzrXrgkByDpm77agDc34WRnQ1/tX/Rq37o7k=; b=HLnfsc9t4Gae6MeZ1Mqc3hrZGpJkletGztKYMKQeaX/oP+/Zfxw56U0CP4YXzOpjs8 FKC81v79/64zvHkiCoFys7IGzcNFvpbmPfHCsa1xCZ0vzAjyh7cj7cctRxNIeIDigUjk dbO4JfxfGw/9clX0RLblrWbvSBMbTz9+WolAJLoNlyUMLkoipUoFm9GMMYCUag801sss E5M13qLfO8D77O578ISLn/Drqw7QCzgNjDctwOTrgWlLFju6t7NG36E6U9gvLhzlOz6S HyAEp3xsosM/f3LjXA22EhXQfm8tdh8qnqBBNXhtV91G9/f58TISG02vaIG1sL24mHxS Wffg== X-Forwarded-Encrypted: i=1; AFNElJ+MPmsdWLKgJrDviaRMb4Eh9a7DP5wlgII/S3EK1kgIcYXStfqijFjts1CWTJk6WTpIdGvoqfeSWu36OiY=@vger.kernel.org X-Gm-Message-State: AOJu0YxmgIXbUu80rit8JeSTRNVZmYc9OL99AGw0/82j4KHhAK5rxfOI TPv8GoirL83imM4gtyYIoeu5xFFv7t2G2bHwVzgjjSF9mDhWHeIWZ2RjLoG6WQGI9tI= X-Gm-Gg: Acq92OF/vYvpJlRXHr21g1n8b/qUmWYIH/pkEfT2oiFSybjMYzKsrbAxrGtqI73GXPj s+OCIxL+We6KbCtBMZQw47628L0OdvvRbCoTYWKsFEE2cC9dpBZsaS18PF7VFxa8+G/NYFNlpUM ezDw5TGrjHr70KgNp8dEig8dq7O33g44rNJc8ma3ymkzmFDNBoI2DpuAkrv5+fpPj/5Xx81CNCG lLHLRJtfrsnEUQvWkkJjqMp+3EIQO4WBqy2W15kXJaDW/eQLIVV/cA4H1fDqE5MPmDbAwKNcIxV jYceIYRplwgLUM/oG0eS4XkWbAK98kQq3Z89vo+njwnOGBGIhrWNLLoVSpwqPKohe5lSpT65j2/ 46djLogz7F/mny0ZecDCdsCPFk827didVF181ml1k1QLtTRg3WgQxmCP7sJvO/k9r25Xgy/uuNE uXwr2/TLoIL9E3HYQgqxoBy8LGrcm/KTf62Xfufw== X-Received: by 2002:a05:6214:5e92:b0:8ce:d101:6266 with SMTP id 6a1803df08f44-8cee5fbe38bmr217636236d6.5.1780964053829; Mon, 08 Jun 2026 17:14:13 -0700 (PDT) Received: from localhost ([161.35.96.86]) by smtp.gmail.com with UTF8SMTPSA id 6a1803df08f44-8cecd06f5eesm182902036d6.37.2026.06.08.17.14.12 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 08 Jun 2026 17:14:12 -0700 (PDT) From: Samuel Moelius To: Ian Abbott Cc: Samuel Moelius , H Hartley Sweeten , Greg Kroah-Hartman , linux-kernel@vger.kernel.org (open list) Subject: [PATCH] comedi: comedi_test: avoid AI scan timing overflow Date: Tue, 9 Jun 2026 00:14:04 +0000 Message-ID: <20260609001221.1234948.362a4ba725ef.comedi-test-ai-timing-overflow@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit `waveform_ai_cmdtest()` tries to keep timer-driven analog-input scans representable by limiting `convert_arg` and by making `scan_begin_arg` at least `convert_arg * scan_end_arg`. The conversion clamp tested `scan_begin_arg == TRIG_TIMER` instead of `scan_begin_src == TRIG_TIMER`, so normal timer scans skipped the clamp. The later product was computed in `unsigned int`, allowing a large conversion period to wrap and produce an accepted command whose true scan conversion time exceeds the scan period. Require timer conversions to be at least one microsecond, apply the conversion limit when `scan_begin_src` is `TRIG_TIMER`, keep that limit on the same microsecond granularity as the rounded argument, and compute the scan-period floor in 64-bit before clamping it back to the ioctl argument range. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius --- drivers/comedi/drivers/comedi_test.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/comedi/drivers/comedi_test.c b/drivers/comedi/drivers/comedi_test.c index 1f430ffc7bd9..04b982f69751 100644 --- a/drivers/comedi/drivers/comedi_test.c +++ b/drivers/comedi/drivers/comedi_test.c @@ -256,7 +256,8 @@ static int waveform_ai_cmdtest(struct comedi_device *dev, struct comedi_cmd *cmd) { int err = 0; - unsigned int arg, limit; + unsigned int arg, limit, min_scan_arg; + u64 min_scan_time; /* Step 1 : check if triggers are trivially valid */ @@ -292,10 +293,8 @@ static int waveform_ai_cmdtest(struct comedi_device *dev, if (cmd->convert_src == TRIG_NOW) { err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0); } else { /* cmd->convert_src == TRIG_TIMER */ - if (cmd->scan_begin_src == TRIG_FOLLOW) { - err |= comedi_check_trigger_arg_min(&cmd->convert_arg, - NSEC_PER_USEC); - } + err |= comedi_check_trigger_arg_min(&cmd->convert_arg, + NSEC_PER_USEC); } if (cmd->scan_begin_src == TRIG_FOLLOW) { @@ -342,7 +341,12 @@ static int waveform_ai_cmdtest(struct comedi_device *dev, arg = NSEC_PER_USEC * DIV_ROUND_CLOSEST(arg, NSEC_PER_USEC); if (cmd->convert_src == TRIG_TIMER) { /* but ensure scan_begin_arg is large enough */ - arg = max(arg, cmd->convert_arg * cmd->scan_end_arg); + min_scan_time = (u64)cmd->convert_arg * cmd->scan_end_arg; + if (min_scan_time > UINT_MAX) + min_scan_arg = UINT_MAX; + else + min_scan_arg = min_scan_time; + arg = max(arg, min_scan_arg); } err |= comedi_check_trigger_arg_is(&cmd->scan_begin_arg, arg); } -- 2.43.0