GP2 is a free-running 32-bit microsecond hardware counter. The PTP code converts a u32 GP2 value to nanoseconds as: gp2 * NSEC_PER_USEC NSEC_PER_USEC is a plain 'long' (1000L), so on 32-bit builds this multiplication is evaluated in 32-bit arithmetic and overflows once the GP2 value exceeds ~4.29 million microseconds (~4.3 s). GP2 wraps only every 2^32 microseconds (~71.5 min), so the product is truncated for almost the entire counter range, producing bogus PTP timestamps. Neighbouring conversions already cast to u64 first (e.g. (u64)gp2 * NSEC_PER_USEC); these sites just missed the cast. Cast to u64 so the multiplication is performed in 64-bit, matching the existing call sites. 64-bit builds are unaffected. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Fixes: f1699ad5857d ("wifi: iwlwifi: mld: add debugfs for using ptp clock time for monitor interface") Signed-off-by: Zhan Xusheng --- drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 4 ++-- drivers/net/wireless/intel/iwlwifi/mld/rx.c | 6 ++---- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c index 1ac85d6ce1d7..81645f8caa54 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c @@ -59,7 +59,7 @@ static void iwl_mld_ptp_update_new_read(struct iwl_mld *mld, u32 gp2) u64 iwl_mld_ptp_get_adj_time(struct iwl_mld *mld, u64 base_time_ns) { struct ptp_data *data = &mld->ptp_data; - u64 scale_time_gp2_ns = mld->ptp_data.scale_update_gp2 * NSEC_PER_USEC; + u64 scale_time_gp2_ns = (u64)mld->ptp_data.scale_update_gp2 * NSEC_PER_USEC; u64 res; u64 diff; s64 scaled_diff; @@ -159,7 +159,7 @@ static int iwl_mld_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm) spin_lock_bh(&data->lock); data->scale_update_adj_time_ns = - iwl_mld_ptp_get_adj_time(mld, gp2 * NSEC_PER_USEC); + iwl_mld_ptp_get_adj_time(mld, (u64)gp2 * NSEC_PER_USEC); data->scale_update_gp2 = gp2; /* scale_update_adj_time_ns now relects the configured delta, the diff --git a/drivers/net/wireless/intel/iwlwifi/mld/rx.c b/drivers/net/wireless/intel/iwlwifi/mld/rx.c index 269439d789f4..108ac70bfb14 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/rx.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/rx.c @@ -1524,10 +1524,8 @@ static void iwl_mld_rx_fill_status(struct iwl_mld *mld, int link_id, iwl_mld_add_rtap_sniffer_config(mld, skb); if (mld->monitor.ptp_time) { - u64 adj_time = - iwl_mld_ptp_get_adj_time(mld, - phy_data->gp2_on_air_rise * - NSEC_PER_USEC); + u64 gp2_ns = (u64)phy_data->gp2_on_air_rise * NSEC_PER_USEC; + u64 adj_time = iwl_mld_ptp_get_adj_time(mld, gp2_ns); rx_status->mactime = div64_u64(adj_time, NSEC_PER_USEC); rx_status->flag |= RX_FLAG_MACTIME_IS_RTAP_TS64; -- 2.43.0