[PATCH] pwm: ipq: prevent potential 32-bit integer overflow in hi_div calculation

[PATCH] pwm: ipq: prevent potential 32-bit integer overflow in hi_div calculation

[kr494167]

From: Surendra Singh Chouhan <kr494167@gmail.com>

In ipq_pwm_get_state(), hi_div was calculated as:
  hi_div = hi_dur * (pre_div + 1);

hi_dur and (pre_div + 1) are both unsigned int (32-bit) values.
Evaluating their multiplication using 32-bit arithmetic before assigning to
the 64-bit u64 hi_div variable can overflow 32-bit unsigned math.

While effective_div explicitly uses (u64)(pwm_div + 1) * (pre_div + 1) to
prevent overflow, hi_div was missing the (u64) cast.

Fix this by casting hi_dur to (u64) before multiplication, matching the
precision used for effective_div.

Fixes: c436e3e9c265 ("pwm: Driver for qualcomm ipq6018 pwm block")
Signed-off-by: Surendra Singh Chouhan <kr494167@gmail.com>
---
 drivers/pwm/pwm-ipq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pwm/pwm-ipq.c b/drivers/pwm/pwm-ipq.c
index c53373948136..e27ddc8e9fea 100644
--- a/drivers/pwm/pwm-ipq.c
+++ b/drivers/pwm/pwm-ipq.c
@@ -186,7 +186,7 @@ static int ipq_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
 	state->period = DIV64_U64_ROUND_UP(effective_div * NSEC_PER_SEC,
 					   ipq_chip->clk_rate);
 
-	hi_div = hi_dur * (pre_div + 1);
+	hi_div = (u64)hi_dur * (pre_div + 1);
 	state->duty_cycle = DIV64_U64_ROUND_UP(hi_div * NSEC_PER_SEC,
 					       ipq_chip->clk_rate);
 
-- 
2.55.0

Re: [PATCH] pwm: ipq: prevent potential 32-bit integer overflow in hi_div calculation

[Uwe Kleine-König]

[-- Attachment #1: Type: text/plain, Size: 1113 bytes --]

Hello,

On Fri, Jul 24, 2026 at 10:18:54AM +0530, kr494167@gmail.com wrote:
> From: Surendra Singh Chouhan <kr494167@gmail.com>
> 
> In ipq_pwm_get_state(), hi_div was calculated as:
>   hi_div = hi_dur * (pre_div + 1);
> 
> hi_dur and (pre_div + 1) are both unsigned int (32-bit) values.
> Evaluating their multiplication using 32-bit arithmetic before assigning to
> the 64-bit u64 hi_div variable can overflow 32-bit unsigned math.
> 
> While effective_div explicitly uses (u64)(pwm_div + 1) * (pre_div + 1) to
> prevent overflow, hi_div was missing the (u64) cast.
> 
> Fix this by casting hi_dur to (u64) before multiplication, matching the
> precision used for effective_div.
> 
> Fixes: c436e3e9c265 ("pwm: Driver for qualcomm ipq6018 pwm block")
> Signed-off-by: Surendra Singh Chouhan <kr494167@gmail.com>

Applied to

https://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux.git pwm/for-next

. Did you find this issue by code review or does it trigger easily? If
the latter you might be able to convince me to send this patch to Linus
before 7.3.

Best regards
Uwe

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH] pwm: ipq: prevent potential 32-bit integer overflow in hi_div calculation

[Surendra Singh]

Hi Uwe,

Thanks for applying the patch!

I noticed this during code review while comparing how effective_div
was calculated vs hi_div in ipq_pwm_get_state().

It can trigger easily on hardware whenever long periods or low clock
frequencies are configured. Specifically, when (hi_dur * (pre_div +
1)) exceeds UINT_MAX (0xffffffff), 32-bit multiplication overflows
before assignment to the 64-bit hi_div variable, resulting in an
incorrect/truncated duty_cycle being reported via pwm_get_state() to
userspace.

Sending it for 7.2 / current cycle as a bug fix would be great.

Thanks,
Surendra Singh Chouhan

On Mon, 7 Sept 2026 at 15:21, Uwe Kleine-König <ukleinek@kernel.org> wrote:
>
> Hello,
>
> On Fri, Jul 24, 2026 at 10:18:54AM +0530, kr494167@gmail.com wrote:
> > From: Surendra Singh Chouhan <kr494167@gmail.com>
> >
> > In ipq_pwm_get_state(), hi_div was calculated as:
> >   hi_div = hi_dur * (pre_div + 1);
> >
> > hi_dur and (pre_div + 1) are both unsigned int (32-bit) values.
> > Evaluating their multiplication using 32-bit arithmetic before assigning to
> > the 64-bit u64 hi_div variable can overflow 32-bit unsigned math.
> >
> > While effective_div explicitly uses (u64)(pwm_div + 1) * (pre_div + 1) to
> > prevent overflow, hi_div was missing the (u64) cast.
> >
> > Fix this by casting hi_dur to (u64) before multiplication, matching the
> > precision used for effective_div.
> >
> > Fixes: c436e3e9c265 ("pwm: Driver for qualcomm ipq6018 pwm block")
> > Signed-off-by: Surendra Singh Chouhan <kr494167@gmail.com>
>
> Applied to
>
> https://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux.git pwm/for-next
>
> . Did you find this issue by code review or does it trigger easily? If
> the latter you might be able to convince me to send this patch to Linus
> before 7.3.
>
> Best regards
> Uwe