Commit 99765db2 authored by Axel Lin's avatar Axel Lin Committed by Guenter Roeck

hwmon: (lm77) Prevent overflow problem when writing large limits

On platforms with sizeof(int) < sizeof(long), writing a temperature
limit larger than MAXINT will result in unpredictable limit values
written to the chip.
Clamp the input values to the supported limits first to fix the problem.

For set_temp_hyst:
As Guenter pointed out that the temperature is read as unsigned and stored in
an unsigned long. This is wrong; nothing in the datasheet suggests that the
value (the absolute temperature) must be positive.
So change it to signed.
Signed-off-by: default avatarAxel Lin <axel.lin@ingics.com>
Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
parent cf44819c
...@@ -80,8 +80,7 @@ struct lm77_data { ...@@ -80,8 +80,7 @@ struct lm77_data {
*/ */
static inline s16 LM77_TEMP_TO_REG(int temp) static inline s16 LM77_TEMP_TO_REG(int temp)
{ {
int ntemp = clamp_val(temp, LM77_TEMP_MIN, LM77_TEMP_MAX); return (temp / 500) * 8;
return (ntemp / 500) * 8;
} }
static inline int LM77_TEMP_FROM_REG(s16 reg) static inline int LM77_TEMP_FROM_REG(s16 reg)
...@@ -175,6 +174,7 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *devattr, ...@@ -175,6 +174,7 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *devattr,
if (err) if (err)
return err; return err;
val = clamp_val(val, LM77_TEMP_MIN, LM77_TEMP_MAX);
mutex_lock(&data->update_lock); mutex_lock(&data->update_lock);
data->temp[nr] = val; data->temp[nr] = val;
lm77_write_value(client, temp_regs[nr], LM77_TEMP_TO_REG(val)); lm77_write_value(client, temp_regs[nr], LM77_TEMP_TO_REG(val));
...@@ -192,15 +192,16 @@ static ssize_t set_temp_hyst(struct device *dev, ...@@ -192,15 +192,16 @@ static ssize_t set_temp_hyst(struct device *dev,
{ {
struct lm77_data *data = dev_get_drvdata(dev); struct lm77_data *data = dev_get_drvdata(dev);
struct i2c_client *client = data->client; struct i2c_client *client = data->client;
unsigned long val; long val;
int err; int err;
err = kstrtoul(buf, 10, &val); err = kstrtol(buf, 10, &val);
if (err) if (err)
return err; return err;
mutex_lock(&data->update_lock); mutex_lock(&data->update_lock);
data->temp[t_hyst] = data->temp[t_crit] - val; val = clamp_val(data->temp[t_crit] - val, LM77_TEMP_MIN, LM77_TEMP_MAX);
data->temp[t_hyst] = val;
lm77_write_value(client, LM77_REG_TEMP_HYST, lm77_write_value(client, LM77_REG_TEMP_HYST,
LM77_TEMP_TO_REG(data->temp[t_hyst])); LM77_TEMP_TO_REG(data->temp[t_hyst]));
mutex_unlock(&data->update_lock); mutex_unlock(&data->update_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment