[lvc-project] [PATCH] drm/bridge: tc358767: prevent overflow in PLL calculation

[Dmitriy Okunev]

In the tc_pxl_pll_calc() function, the expression `pixelclock *
ext_div[i_pre] * ext_div[i_post] * div` is calculated using
32‑bit arithmetic, since all operands are of type u32 or int.

pixelclock takes the maximum value of 154 MHz (in accordance
with tc_edp_mode_valid()), ext_div[...] takes the value 7, and
div ranges from 1 to 16, inclusive. The maximum product
(154,000,000 * 7 * 7 * 16) is approximately 1.2e11, which is much
larger than UINT32_MAX, leading to an overflow and, as a result,
to an incorrect value of the PLL multiplier.

Fix this by casting `pixelclock` to `u64` before the multiplication,
ensuring all arithmetic is performed in 64-bit precision.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 7caff0fc4296 ("drm/bridge: tc358767: Add DPI to eDP bridge driver")
Signed-off-by: Dmitriy Okunev <dokunevdmitriy at gmail.com>
---
 drivers/gpu/drm/bridge/tc358767.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index e3a57f8228da..39633f618664 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -640,7 +640,7 @@ static int tc_pxl_pll_calc(struct tc_data *tc, u32 refclk, u32 pixelclock,
 				if (iclk < 6000000 || iclk > 40000000)
 					continue;
 
-				tmp = pixelclock * ext_div[i_pre] *
+				tmp = (u64)pixelclock * ext_div[i_pre] *
 				      ext_div[i_post] * div;
 				do_div(tmp, refclk);
 				mul = tmp;
-- 
2.53.0