Commit 99348bde authored by Axel Lin's avatar Axel Lin Committed by Greg Kroah-Hartman

hwmon: (lm92) Prevent overflow problem when writing large limits

commit 5b963089 upstream.

On platforms with sizeof(int) < sizeof(long), writing a temperature
limit larger than MAXINT will result in unpredictable limit values
written to the chip. Avoid auto-conversion from long to int to fix
the problem.

The hysteresis temperature range depends on the value of
data->temp[attr->index], since val is subtracted from it.
Use a wider clamp, [-120000, 220000] should do to cover the
possible range. Also add missing TEMP_TO_REG() on writes into
cached hysteresis value.

Also uses clamp_val to simplify the code a bit.
Signed-off-by: default avatarAxel Lin <axel.lin@ingics.com>
[Guenter Roeck: Fixed double TEMP_TO_REG on hysteresis updates]
Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 26a05f26
...@@ -74,12 +74,9 @@ static inline int TEMP_FROM_REG(s16 reg) ...@@ -74,12 +74,9 @@ static inline int TEMP_FROM_REG(s16 reg)
return reg / 8 * 625 / 10; return reg / 8 * 625 / 10;
} }
static inline s16 TEMP_TO_REG(int val) static inline s16 TEMP_TO_REG(long val)
{ {
if (val <= -60000) val = clamp_val(val, -60000, 160000);
return -60000 * 10 / 625 * 8;
if (val >= 160000)
return 160000 * 10 / 625 * 8;
return val * 10 / 625 * 8; return val * 10 / 625 * 8;
} }
...@@ -206,10 +203,12 @@ static ssize_t set_temp_hyst(struct device *dev, ...@@ -206,10 +203,12 @@ static ssize_t set_temp_hyst(struct device *dev,
if (err) if (err)
return err; return err;
val = clamp_val(val, -120000, 220000);
mutex_lock(&data->update_lock); mutex_lock(&data->update_lock);
data->temp[t_hyst] = TEMP_FROM_REG(data->temp[attr->index]) - val; data->temp[t_hyst] =
TEMP_TO_REG(TEMP_FROM_REG(data->temp[attr->index]) - val);
i2c_smbus_write_word_swapped(client, LM92_REG_TEMP_HYST, i2c_smbus_write_word_swapped(client, LM92_REG_TEMP_HYST,
TEMP_TO_REG(data->temp[t_hyst])); data->temp[t_hyst]);
mutex_unlock(&data->update_lock); mutex_unlock(&data->update_lock);
return count; return count;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment