Bug in mtd_speedtest?

I think I may have found an overflow condition in the speed calculation of mtd_speedtest on some platforms with larger flash partitions:

Consider for example if goodebcnt = 15000, and mtd->erasesize = 256*1024, then there is an intermediate product of 3932160000 which results in the sign bit being set on a 32 bit integer. Maybe k should be an unsigned long long?

.....
static long calc_speed(void)

{
    long ms, k, speed;

    ms = (finish.tv_sec - start.tv_sec) * 1000 +
         (finish.tv_usec - start.tv_usec) / 1000;
    k = goodebcnt * mtd->erasesize / 1024;
    speed = (k * 1000) / ms;
    return speed;
}

.....

Please, just send a patch :-)

Best Regards,
Artem Bityutskiy (Артём Битюцкий)

Artem,
Please find attached patch.

Regards,

Dave.

Index: mtd_speedtest.c
===================================================================
RCS file: /home/cvsroot/ECMB/src/snapgear/linux-2.6.30.1.x/drivers/mtd/tests/mtd_speedtest.c,v retrieving revision 1.1.1.1

diff -u -r1.1.1.1 mtd_speedtest.c
@@ -281,13 +281,14 @@
 
 static long calc_speed(void)
 {
-	long ms, k, speed;
+	uint64_t k;
+	long ms;
 
-	ms = (finish.tv_sec - start.tv_sec) * 1000 +
-	     (finish.tv_usec - start.tv_usec) / 1000;
-	k = goodebcnt * mtd->erasesize / 1024;
-	speed = (k * 1000) / ms;
-	return speed;
+	ms = (finish.tv_sec - start.tv_sec) * 1000 + /* Time in milli-seconds from start to ...*/
+	     (finish.tv_usec - start.tv_usec) / 1000;	  /* finish */
+	k = (goodebcnt * (mtd->erasesize / 1024) * 1000); /* Number of kBytes transferred * 1000 */
+	do_div(k, ms);	  /* k now contains number of kBytes/second */
+	return k;
 }
 
 static int scan_for_bad_eraseblocks(void)

The comments make lines over 80 chars and are not needed, it is clear enough from the code what it does.

--
Jon Povey
[email protected]

Racelogic is a limited company registered in England. Registered number 2743719 . Registered Office Unit 10, Swan Business Centre, Osier Way, Buckingham, Bucks, MK18 1TB .

The information contained in this electronic mail transmission is intended by Racelogic Ltd for the use of the named individual or entity to which it is directed and may contain information that is confidential or privileged. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email so that the sender's address records can be corrected. The views expressed by the sender of this communication do not necessarily represent those of Racelogic Ltd. Please note that Racelogic reserves the right to monitor e-mail communications passing through its network

Thank you, but you made pretty good job to prevent me from applying it! :-)

This means git am won't work... neither patch -p1 ...
Also, not author name (From:), not commit message, not Signed-off-by...

From: David Lambert <[email protected]>
Date: Mon, 7 Mar 2011 12:00:46 +0200
Subject: [PATCH] mtd: speedtest: fix integer overflow

32-bit integers used in 'calc_speed()' may overflow and lead to incorrect results. Use 64-bit integers instead.

---
 drivers/mtd/tests/mtd_speedtest.c |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

index 3ce6fce..22b51c1 100644
@@ -314,16 +314,16 @@ static inline void stop_timing(void)
 
 static long calc_speed(void)
 {
-	long ms, k, speed;
+       uint64_t k;
+       long ms;
 
 	ms = (finish.tv_sec - start.tv_sec) * 1000 +
 	     (finish.tv_usec - start.tv_usec) / 1000;
-	k = goodebcnt * mtd->erasesize / 1024;
-	if (ms)
-		speed = (k * 1000) / ms;
-	else
-		speed = 0;
-	return speed;
+	if (ms == 0)
+		return 0;
+	k = goodebcnt * (mtd->erasesize / 1024) * 1000;
+	do_div(k, ms);
+	return k;
 }
 
 static int scan_for_bad_eraseblocks(void)

1.7.2.3

-- 
Best Regards,
Artem Bityutskiy (Артём Битюцкий)