| From 5b963089161b8fb244889c972edf553b9d737545 Mon Sep 17 00:00:00 2001 |
| From: Axel Lin <axel.lin@ingics.com> |
| Date: Tue, 5 Aug 2014 10:08:31 +0800 |
| Subject: hwmon: (lm92) Prevent overflow problem when writing large limits |
| |
| From: Axel Lin <axel.lin@ingics.com> |
| |
| commit 5b963089161b8fb244889c972edf553b9d737545 upstream. |
| |
| On platforms with sizeof(int) < sizeof(long), writing a temperature |
| limit larger than MAXINT will result in unpredictable limit values |
| written to the chip. Avoid auto-conversion from long to int to fix |
| the problem. |
| |
| The hysteresis temperature range depends on the value of |
| data->temp[attr->index], since val is subtracted from it. |
| Use a wider clamp, [-120000, 220000] should do to cover the |
| possible range. Also add missing TEMP_TO_REG() on writes into |
| cached hysteresis value. |
| |
| Also uses clamp_val to simplify the code a bit. |
| |
| Signed-off-by: Axel Lin <axel.lin@ingics.com> |
| [Guenter Roeck: Fixed double TEMP_TO_REG on hysteresis updates] |
| Signed-off-by: Guenter Roeck <linux@roeck-us.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/hwmon/lm92.c | 13 ++++++------- |
| 1 file changed, 6 insertions(+), 7 deletions(-) |
| |
| --- a/drivers/hwmon/lm92.c |
| +++ b/drivers/hwmon/lm92.c |
| @@ -74,12 +74,9 @@ static inline int TEMP_FROM_REG(s16 reg) |
| return reg / 8 * 625 / 10; |
| } |
| |
| -static inline s16 TEMP_TO_REG(int val) |
| +static inline s16 TEMP_TO_REG(long val) |
| { |
| - if (val <= -60000) |
| - return -60000 * 10 / 625 * 8; |
| - if (val >= 160000) |
| - return 160000 * 10 / 625 * 8; |
| + val = clamp_val(val, -60000, 160000); |
| return val * 10 / 625 * 8; |
| } |
| |
| @@ -206,10 +203,12 @@ static ssize_t set_temp_hyst(struct devi |
| if (err) |
| return err; |
| |
| + val = clamp_val(val, -120000, 220000); |
| mutex_lock(&data->update_lock); |
| - data->temp[t_hyst] = TEMP_FROM_REG(data->temp[attr->index]) - val; |
| + data->temp[t_hyst] = |
| + TEMP_TO_REG(TEMP_FROM_REG(data->temp[attr->index]) - val); |
| i2c_smbus_write_word_swapped(client, LM92_REG_TEMP_HYST, |
| - TEMP_TO_REG(data->temp[t_hyst])); |
| + data->temp[t_hyst]); |
| mutex_unlock(&data->update_lock); |
| return count; |
| } |