[lvc-project] [PATCH] atm: horizon: Casting type 32 to 64 bits in make_rate().

[Andrey Shumilin]

In one of the 3 cases, 1<<30 is passed as the second
parameter to the make_rate() function.
In the expressions "c << (CR_MAXPEXP+div-br_exp)"
and "c<<div" a shift of 14 is possible.
The INT type may overflow.
To fix this, it is suggested to cast the type.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Andrey Shumilin <shum.sdl at nppct.ru>
---
 drivers/atm/horizon.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
index 4f2951cbe69c..6f3e65e65225 100644
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -631,7 +631,7 @@ static int make_rate (const hrz_dev * dev, u32 c, rounding r,
 	// d == MIND and (c << (MAXPEXP+MIND)) < B
 	while (div < CR_MAXD) {
 		div++;
-		if (br_man <= (c << (CR_MAXPEXP+div-br_exp))) {
+		if (br_man <= ((u64)c << (CR_MAXPEXP+div-br_exp))) {
 			// Equivalent to: B <= (c << (MAXPEXP+d))
 			// c << (MAXPEXP+d-1) < B <= c << (MAXPEXP+d)
 			// 1 << (MAXPEXP-1) < B/2^d/c <= 1 << MAXPEXP
@@ -645,7 +645,7 @@ static int make_rate (const hrz_dev * dev, u32 c, rounding r,
 					pre = DIV_ROUND_CLOSEST(br, c<<div);
 					break;
 				default: /* round_up */
-					pre = br/(c<<div);
+					pre = br/((u64)c<<div);
 			}
 			PRINTD (DBG_QOS, "B: p=%u, d=%u", pre, div);
 			goto got_it;
-- 
2.30.2