mtd: tests: fix integer overflow issues

These multiplications are done with 32-bit arithmetic, then converted to
64-bit. We should widen the integers first to prevent overflow. This
could be a problem for large (>4GB) MTD's.

Detected by Coverity.

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>

diff --git a/drivers/mtd/tests/mtd_test.c b/drivers/mtd/tests/mtd_test.c
index 111ee46a7428e2d8ad384973bdc03e2cb2305122..34736bbcc07be0f622e836f5872d1f830df96cb4 100644 (file)
--- a/drivers/mtd/tests/mtd_test.c
+++ b/drivers/mtd/tests/mtd_test.c
@@ -10,7 +10,7 @@ int mtdtest_erase_eraseblock(struct mtd_info *mtd, unsigned int ebnum)
 {
        int err;
        struct erase_info ei;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        memset(&ei, 0, sizeof(struct erase_info));
        ei.mtd  = mtd;
@@ -33,7 +33,7 @@ int mtdtest_erase_eraseblock(struct mtd_info *mtd, unsigned int ebnum)
 static int is_block_bad(struct mtd_info *mtd, unsigned int ebnum)
 {
        int ret;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        ret = mtd_block_isbad(mtd, addr);
        if (ret)

diff --git a/drivers/mtd/tests/nandbiterrs.c b/drivers/mtd/tests/nandbiterrs.c
index 6f976159611f4ab86ee61033fe6a242b6bc1101f..273f7e5539541ee7fa2bdd7bed0eb659dc2bebca 100644 (file)
--- a/drivers/mtd/tests/nandbiterrs.c
+++ b/drivers/mtd/tests/nandbiterrs.c
@@ -364,7 +364,7 @@ static int __init mtd_nandbiterrs_init(void)
 
        pr_info("Device uses %d subpages of %d bytes\n", subcount, subsize);
 
-       offset     = page_offset * mtd->writesize;
+       offset     = (loff_t)page_offset * mtd->writesize;
        eraseblock = mtd_div_by_eb(offset, mtd);
 
        pr_info("Using page=%u, offset=%llu, eraseblock=%u\n",

diff --git a/drivers/mtd/tests/oobtest.c b/drivers/mtd/tests/oobtest.c
index f19ab1acde1f22dedaf700e5dd8919bebf33f2c4..dc4f9602b97ec45e82ae99ece70d8e3fc2b274d1 100644 (file)
--- a/drivers/mtd/tests/oobtest.c
+++ b/drivers/mtd/tests/oobtest.c
@@ -120,7 +120,7 @@ static int verify_eraseblock(int ebnum)
        int i;
        struct mtd_oob_ops ops;
        int err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        prandom_bytes_state(&rnd_state, writebuf, use_len_max * pgcnt);
        for (i = 0; i < pgcnt; ++i, addr += mtd->writesize) {
@@ -214,7 +214,7 @@ static int verify_eraseblock_in_one_go(int ebnum)
 {
        struct mtd_oob_ops ops;
        int err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
        size_t len = mtd->ecclayout->oobavail * pgcnt;
 
        prandom_bytes_state(&rnd_state, writebuf, len);
@@ -568,7 +568,7 @@ static int __init mtd_oobtest_init(void)
                size_t sz = mtd->ecclayout->oobavail;
                if (bbt[i] || bbt[i + 1])
                        continue;
-               addr = (i + 1) * mtd->erasesize - mtd->writesize;
+               addr = (loff_t)(i + 1) * mtd->erasesize - mtd->writesize;
                prandom_bytes_state(&rnd_state, writebuf, sz * cnt);
                for (pg = 0; pg < cnt; ++pg) {
                        ops.mode      = MTD_OPS_AUTO_OOB;
@@ -598,7 +598,7 @@ static int __init mtd_oobtest_init(void)
                        continue;
                prandom_bytes_state(&rnd_state, writebuf,
                                        mtd->ecclayout->oobavail * 2);
-               addr = (i + 1) * mtd->erasesize - mtd->writesize;
+               addr = (loff_t)(i + 1) * mtd->erasesize - mtd->writesize;
                ops.mode      = MTD_OPS_AUTO_OOB;
                ops.len       = 0;
                ops.retlen    = 0;

diff --git a/drivers/mtd/tests/pagetest.c b/drivers/mtd/tests/pagetest.c
index ed2d3f656fd2ffd41fca36537244e27d7d7fe712..88296e888e9d6518a398384d26c68a0d7744bcb9 100644 (file)
--- a/drivers/mtd/tests/pagetest.c
+++ b/drivers/mtd/tests/pagetest.c
@@ -52,7 +52,7 @@ static struct rnd_state rnd_state;
 
 static int write_eraseblock(int ebnum)
 {
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        prandom_bytes_state(&rnd_state, writebuf, mtd->erasesize);
        cond_resched();
@@ -64,7 +64,7 @@ static int verify_eraseblock(int ebnum)
        uint32_t j;
        int err = 0, i;
        loff_t addr0, addrn;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        addr0 = 0;
        for (i = 0; i < ebcnt && bbt[i]; ++i)

diff --git a/drivers/mtd/tests/readtest.c b/drivers/mtd/tests/readtest.c
index 626e66d0f7e7a081271cae6c88f608edc8be8727..a54cf1511114c31ed5d52a59a7d9814d792a334f 100644 (file)
--- a/drivers/mtd/tests/readtest.c
+++ b/drivers/mtd/tests/readtest.c
@@ -47,7 +47,7 @@ static int pgcnt;
 static int read_eraseblock_by_page(int ebnum)
 {
        int i, ret, err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
        void *buf = iobuf;
        void *oobbuf = iobuf1;
 

diff --git a/drivers/mtd/tests/speedtest.c b/drivers/mtd/tests/speedtest.c
index 87ff6a29f84ee94bacc657aaf6f52700aa45074d..5ee9f7021020dae7a45a90e646a7afa12deeeb7d 100644 (file)
--- a/drivers/mtd/tests/speedtest.c
+++ b/drivers/mtd/tests/speedtest.c
@@ -55,7 +55,7 @@ static int multiblock_erase(int ebnum, int blocks)
 {
        int err;
        struct erase_info ei;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        memset(&ei, 0, sizeof(struct erase_info));
        ei.mtd  = mtd;
@@ -80,7 +80,7 @@ static int multiblock_erase(int ebnum, int blocks)
 
 static int write_eraseblock(int ebnum)
 {
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        return mtdtest_write(mtd, addr, mtd->erasesize, iobuf);
 }
@@ -88,7 +88,7 @@ static int write_eraseblock(int ebnum)
 static int write_eraseblock_by_page(int ebnum)
 {
        int i, err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
        void *buf = iobuf;
 
        for (i = 0; i < pgcnt; i++) {
@@ -106,7 +106,7 @@ static int write_eraseblock_by_2pages(int ebnum)
 {
        size_t sz = pgsize * 2;
        int i, n = pgcnt / 2, err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
        void *buf = iobuf;
 
        for (i = 0; i < n; i++) {
@@ -124,7 +124,7 @@ static int write_eraseblock_by_2pages(int ebnum)
 
 static int read_eraseblock(int ebnum)
 {
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        return mtdtest_read(mtd, addr, mtd->erasesize, iobuf);
 }
@@ -132,7 +132,7 @@ static int read_eraseblock(int ebnum)
 static int read_eraseblock_by_page(int ebnum)
 {
        int i, err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
        void *buf = iobuf;
 
        for (i = 0; i < pgcnt; i++) {
@@ -150,7 +150,7 @@ static int read_eraseblock_by_2pages(int ebnum)
 {
        size_t sz = pgsize * 2;
        int i, n = pgcnt / 2, err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
        void *buf = iobuf;
 
        for (i = 0; i < n; i++) {

diff --git a/drivers/mtd/tests/subpagetest.c b/drivers/mtd/tests/subpagetest.c
index a876371ad410c5eec22c912d924574360d769c90..7b59ef522d5ea9b98431d376b4095451ba9b7f8b 100644 (file)
--- a/drivers/mtd/tests/subpagetest.c
+++ b/drivers/mtd/tests/subpagetest.c
@@ -57,7 +57,7 @@ static int write_eraseblock(int ebnum)
 {
        size_t written;
        int err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        prandom_bytes_state(&rnd_state, writebuf, subpgsize);
        err = mtd_write(mtd, addr, subpgsize, &written, writebuf);
@@ -92,7 +92,7 @@ static int write_eraseblock2(int ebnum)
 {
        size_t written;
        int err = 0, k;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        for (k = 1; k < 33; ++k) {
                if (addr + (subpgsize * k) > (ebnum + 1) * mtd->erasesize)
@@ -131,7 +131,7 @@ static int verify_eraseblock(int ebnum)
 {
        size_t read;
        int err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        prandom_bytes_state(&rnd_state, writebuf, subpgsize);
        clear_data(readbuf, subpgsize);
@@ -192,7 +192,7 @@ static int verify_eraseblock2(int ebnum)
 {
        size_t read;
        int err = 0, k;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        for (k = 1; k < 33; ++k) {
                if (addr + (subpgsize * k) > (ebnum + 1) * mtd->erasesize)
@@ -227,7 +227,7 @@ static int verify_eraseblock_ff(int ebnum)
        uint32_t j;
        size_t read;
        int err = 0;
-       loff_t addr = ebnum * mtd->erasesize;
+       loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
        memset(writebuf, 0xff, subpgsize);
        for (j = 0; j < mtd->erasesize / subpgsize; ++j) {