From a662d944da1e9236a99355aa3e8a93735d8b3521 Mon Sep 17 00:00:00 2001 From: Surendra Singh Chouhan Date: Fri, 24 Jul 2026 10:18:54 +0530 Subject: [PATCH] pwm: ipq: Prevent potential 32-bit integer overflow in hi_div calculation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In ipq_pwm_get_state(), hi_div was calculated as: hi_div = hi_dur * (pre_div + 1); hi_dur and (pre_div + 1) are both unsigned int (32-bit) values. Evaluating their multiplication using 32-bit arithmetic before assigning to the 64-bit u64 hi_div variable can overflow 32-bit unsigned math. While effective_div explicitly uses (u64)(pwm_div + 1) * (pre_div + 1) to prevent overflow, hi_div was missing the (u64) cast. Fix this by casting hi_dur to (u64) before multiplication, matching the precision used for effective_div. Fixes: c436e3e9c265 ("pwm: Driver for qualcomm ipq6018 pwm block") Signed-off-by: Surendra Singh Chouhan Link: https://patch.msgid.link/20260724044854.33274-1-kr494167@gmail.com Signed-off-by: Uwe Kleine-König --- drivers/pwm/pwm-ipq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pwm/pwm-ipq.c b/drivers/pwm/pwm-ipq.c index 6b7aec566f7e..3e1231b212b1 100644 --- a/drivers/pwm/pwm-ipq.c +++ b/drivers/pwm/pwm-ipq.c @@ -186,7 +186,7 @@ static int ipq_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm, state->period = DIV64_U64_ROUND_UP(effective_div * NSEC_PER_SEC, ipq_chip->clk_rate); - hi_div = hi_dur * (pre_div + 1); + hi_div = (u64)hi_dur * (pre_div + 1); state->duty_cycle = DIV64_U64_ROUND_UP(hi_div * NSEC_PER_SEC, ipq_chip->clk_rate);