Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

hwmon: (emcw201) Fix overflows seen when writing into limit attributes

Writes into temperature and voltage limit attributes can overflow
due to multiplications with unchecked parameters. Also, the input
parameter to DIV_ROUND_CLOSEST() needis to be range checked.

Reviewed-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

+5 -3
+5 -3
drivers/hwmon/emc6w201.c
··· 215 215 if (err < 0) 216 216 return err; 217 217 218 - val = DIV_ROUND_CLOSEST(val * 0xC0, nominal_mv[nr]); 218 + val = clamp_val(val, 0, 255 * nominal_mv[nr] / 192); 219 + val = DIV_ROUND_CLOSEST(val * 192, nominal_mv[nr]); 219 220 reg = (sf == min) ? EMC6W201_REG_IN_LOW(nr) 220 221 : EMC6W201_REG_IN_HIGH(nr); 221 222 222 223 mutex_lock(&data->update_lock); 223 - data->in[sf][nr] = clamp_val(val, 0, 255); 224 + data->in[sf][nr] = val; 224 225 err = emc6w201_write8(client, reg, data->in[sf][nr]); 225 226 mutex_unlock(&data->update_lock); 226 227 ··· 253 252 if (err < 0) 254 253 return err; 255 254 255 + val = clamp_val(val, -127000, 127000); 256 256 val = DIV_ROUND_CLOSEST(val, 1000); 257 257 reg = (sf == min) ? EMC6W201_REG_TEMP_LOW(nr) 258 258 : EMC6W201_REG_TEMP_HIGH(nr); 259 259 260 260 mutex_lock(&data->update_lock); 261 - data->temp[sf][nr] = clamp_val(val, -127, 127); 261 + data->temp[sf][nr] = val; 262 262 err = emc6w201_write8(client, reg, data->temp[sf][nr]); 263 263 mutex_unlock(&data->update_lock); 264 264