Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

hwmon: (lm90) Prevent integer underflows of temperature calculations

The min/max/crit and all other temperature values that are passed to
the driver are unlimited and value that is close to INT_MIN results in
integer underflow of the temperature calculations made by the driver
for LM99 sensor. Temperature hysteresis is among those values that need
to be limited, but limiting of hysteresis is independent from the sensor
version. Add the missing limits.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20210623042231.16008-2-digetx@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

authored by

Dmitry Osipenko and committed by
Guenter Roeck
b50aa496 4c7f85a3

+11 -2
+11 -2
drivers/hwmon/lm90.c
··· 1029 1029 int err; 1030 1030 1031 1031 /* +16 degrees offset for temp2 for the LM99 */ 1032 - if (data->kind == lm99 && index <= 2) 1032 + if (data->kind == lm99 && index <= 2) { 1033 + /* prevent integer underflow */ 1034 + val = max(val, -128000l); 1033 1035 val -= 16000; 1036 + } 1034 1037 1035 1038 if (data->kind == adt7461 || data->kind == tmp451) 1036 1039 data->temp11[index] = temp_to_u16_adt7461(data, val); ··· 1092 1089 int err; 1093 1090 1094 1091 /* +16 degrees offset for temp2 for the LM99 */ 1095 - if (data->kind == lm99 && index == 3) 1092 + if (data->kind == lm99 && index == 3) { 1093 + /* prevent integer underflow */ 1094 + val = max(val, -128000l); 1096 1095 val -= 16000; 1096 + } 1097 1097 1098 1098 if (data->kind == adt7461 || data->kind == tmp451) 1099 1099 data->temp8[index] = temp_to_u8_adt7461(data, val); ··· 1142 1136 temp = temp_from_u8(data->temp8[LOCAL_CRIT]); 1143 1137 else 1144 1138 temp = temp_from_s8(data->temp8[LOCAL_CRIT]); 1139 + 1140 + /* prevent integer underflow */ 1141 + val = max(val, -128000l); 1145 1142 1146 1143 data->temp_hyst = hyst_to_reg(temp - val); 1147 1144 err = i2c_smbus_write_byte_data(client, LM90_REG_W_TCRIT_HYST,