hwmon: (max6697) Fix underflow when writing limit attributes
authorGuenter Roeck <linux@roeck-us.net>
Sat, 13 Jul 2024 21:26:19 +0000 (14:26 -0700)
committerGuenter Roeck <linux@roeck-us.net>
Sun, 14 Jul 2024 18:48:50 +0000 (11:48 -0700)
Using DIV_ROUND_CLOSEST() on an unbound value can result in underflows.
Indeed, module test scripts report:

temp1_max: Suspected underflow: [min=0, read 255000, written -9223372036854775808]
temp1_crit: Suspected underflow: [min=0, read 255000, written -9223372036854775808]

Fix by introducing an extra set of clamping.

Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles")
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
drivers/hwmon/max6697.c

index b28b7b9448aa863b3508d7e9f5f0251e06ed790a..05085646ba99825b28cfc147c62d8b256700a2d6 100644 (file)
@@ -311,6 +311,7 @@ static ssize_t temp_store(struct device *dev,
                return ret;
 
        mutex_lock(&data->update_lock);
+       temp = clamp_val(temp, -1000000, 1000000);      /* prevent underflow */
        temp = DIV_ROUND_CLOSEST(temp, 1000) + data->temp_offset;
        temp = clamp_val(temp, 0, data->type == max6581 ? 255 : 127);
        data->temp[nr][index] = temp;