From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp111.ord1d.emailsrvr.com (smtp111.ord1d.emailsrvr.com [184.106.54.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12A8D3D75B8 for ; Tue, 9 Jun 2026 09:16:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=184.106.54.111 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780996607; cv=none; b=eWw7TNGIhKzL/uLrRXm1wpwckq79WoP5NkibGeFpGBAsP0Wkf4LEexQNqdVyjkx9LP0Dz5H7BeBq6Kg2hXNCuHv7Yb0+FwVq8DkPqx7pRaoVR7FN9PUdkAJGRZODxITAjM0cfiXi7l1yfji5Haw+SAX8YSDNSI54nVCmQ/bWd4Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780996607; c=relaxed/simple; bh=Fbflj+RRe8I0FgJOlxaAwu5RC3F3+5/P2Vf5CSGQBHE=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=ToWn8PWW+hsrkdDHE0DpAtSaqFgMmElk8b6OzOuXKgb+WSqoBYuBbHonFyFbbO0OiOV1ILRfJKvK05pBWf6QIS/W65NslMBCXcOULFMzXBO7cCURBChLscax9US+pb+sJcsLFSFcy2R+PMBRSisGUOUqixwan2OKpBMU0T+QQek= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mev.co.uk; spf=pass smtp.mailfrom=mev.co.uk; dkim=pass (1024-bit key) header.d=mev.co.uk header.i=@mev.co.uk header.b=hVvlMqFg; arc=none smtp.client-ip=184.106.54.111 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mev.co.uk Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mev.co.uk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mev.co.uk header.i=@mev.co.uk header.b="hVvlMqFg" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mev.co.uk; s=20221208-6x11dpa4; t=1780996116; bh=Fbflj+RRe8I0FgJOlxaAwu5RC3F3+5/P2Vf5CSGQBHE=; h=Date:Subject:To:From:From; b=hVvlMqFgvSdmO/hyh6VyPY7O7zAV1aI7n7D9WsqpYu2RFA3xGxNZczrHc97HYJtNn d8548P9txhnIxfIh9RkUqrJR5PD+jsiIOykVZHScaVOJL6KZITCC9b6rR/vUnqMy5S YJfioOdGnYNWlR2ZCQFHS92FO4ZiQQ9ieHujT6sQ= X-Auth-ID: abbotti@mev.co.uk Received: by smtp22.relay.ord1d.emailsrvr.com (Authenticated sender: abbotti-AT-mev.co.uk) with ESMTPSA id D582CE0224; Tue, 9 Jun 2026 05:08:35 -0400 (EDT) Message-ID: Date: Tue, 9 Jun 2026 10:07:44 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] comedi: comedi_test: avoid AI scan timing overflow To: Samuel Moelius Cc: H Hartley Sweeten , Greg Kroah-Hartman , open list References: <20260609001221.1234948.362a4ba725ef.comedi-test-ai-timing-overflow@trailofbits.com> Content-Language: en-GB From: Ian Abbott Organization: MEV Ltd. In-Reply-To: <20260609001221.1234948.362a4ba725ef.comedi-test-ai-timing-overflow@trailofbits.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Classification-ID: 65cf519e-b2f7-467f-8194-51cab133879b-1-1 On 09/06/2026 01:14, Samuel Moelius wrote: > `waveform_ai_cmdtest()` tries to keep timer-driven analog-input scans > representable by limiting `convert_arg` and by making `scan_begin_arg` > at least `convert_arg * scan_end_arg`. > > The conversion clamp tested `scan_begin_arg == TRIG_TIMER` instead of > `scan_begin_src == TRIG_TIMER`, so normal timer scans skipped the clamp. > The later product was computed in `unsigned int`, allowing a large > conversion period to wrap and produce an accepted command whose true > scan conversion time exceeds the scan period. > > Require timer conversions to be at least one microsecond, apply the > conversion limit when `scan_begin_src` is `TRIG_TIMER`, keep that limit > on the same microsecond granularity as the rounded argument, and compute > the scan-period floor in 64-bit before clamping it back to the ioctl > argument range. > > Assisted-by: Codex:gpt-5.5-cyber-preview > Signed-off-by: Samuel Moelius > --- > drivers/comedi/drivers/comedi_test.c | 16 ++++++++++------ > 1 file changed, 10 insertions(+), 6 deletions(-) > > diff --git a/drivers/comedi/drivers/comedi_test.c b/drivers/comedi/drivers/comedi_test.c > index 1f430ffc7bd9..04b982f69751 100644 > --- a/drivers/comedi/drivers/comedi_test.c > +++ b/drivers/comedi/drivers/comedi_test.c > @@ -256,7 +256,8 @@ static int waveform_ai_cmdtest(struct comedi_device *dev, > struct comedi_cmd *cmd) > { > int err = 0; > - unsigned int arg, limit; > + unsigned int arg, limit, min_scan_arg; > + u64 min_scan_time; > > /* Step 1 : check if triggers are trivially valid */ > > @@ -292,10 +293,8 @@ static int waveform_ai_cmdtest(struct comedi_device *dev, > if (cmd->convert_src == TRIG_NOW) { > err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0); > } else { /* cmd->convert_src == TRIG_TIMER */ > - if (cmd->scan_begin_src == TRIG_FOLLOW) { > - err |= comedi_check_trigger_arg_min(&cmd->convert_arg, > - NSEC_PER_USEC); > - } > + err |= comedi_check_trigger_arg_min(&cmd->convert_arg, > + NSEC_PER_USEC); > } > > if (cmd->scan_begin_src == TRIG_FOLLOW) { > @@ -342,7 +341,12 @@ static int waveform_ai_cmdtest(struct comedi_device *dev, > arg = NSEC_PER_USEC * DIV_ROUND_CLOSEST(arg, NSEC_PER_USEC); > if (cmd->convert_src == TRIG_TIMER) { > /* but ensure scan_begin_arg is large enough */ > - arg = max(arg, cmd->convert_arg * cmd->scan_end_arg); > + min_scan_time = (u64)cmd->convert_arg * cmd->scan_end_arg; > + if (min_scan_time > UINT_MAX) > + min_scan_arg = UINT_MAX; > + else > + min_scan_arg = min_scan_time; > + arg = max(arg, min_scan_arg); > } > err |= comedi_check_trigger_arg_is(&cmd->scan_begin_arg, arg); > } If it is done that way, it is possible for scan_begin_arg to end up shorter than scan_end_arg * convert_arg (when both scan_begin_src and convert_src are set to TRIG_TIMER). I prefer to impose an upper limit on convert_arg so that the product of scan_end_arg and convert_arg is <= UINT_MAX. -- -=( Ian Abbott || MEV Ltd. is a company )=- -=( registered in England & Wales. Regd. number: 02862268. )=- -=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=- -=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=-