Skip to contentSkip to conversation

hwmon (occ): Fix integer overflow in multiplication

PATCH Applied Eddie James 2 participants 2 messages Dec 19, 2017 – Jan 16, 2018 Hardware monitoring

lore
Share & tools
lore
#0 lore raw

PATCH v3 1/1 hwmon (occ): Fix integer overflow in multiplication

Power values were overflowing INT_MAX when being converted to microwatts, even though the storage was sufficiently large (unsigned 64 bit). Change literals to unsigned long long. Also change tmep storage to u32 to avoid overflows at 65000 millidegrees.

---
 drivers/hwmon/occ/common.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/hwmon/occ/common.c +9 -9
index 3175e7b..2e188d5 100644
@@ -353,7 +353,7 @@ static ssize_t occ_show_temp_1(struct device *dev,
 			       struct device_attribute *attr, char *buf)
 {
 	int rc;
-	u16 val = 0;
+	u32 val = 0;
 	struct temp_sensor_1 *temp;
 	struct occ *occ = dev_get_drvdata(dev);
 	struct occ_sensors *sensors = &occ->sensors;
@@ -468,7 +468,7 @@ static ssize_t occ_show_power_1(struct device *dev,
 				struct device_attribute *attr, char *buf)
 {
 	int rc;
-	u32 val = 0;
+	u64 val = 0;
 	struct power_sensor_1 *power;
 	struct occ *occ = dev_get_drvdata(dev);
 	struct occ_sensors *sensors = &occ->sensors;
@@ -491,11 +491,11 @@ static ssize_t occ_show_power_1(struct device *dev,
 		val = get_unaligned_be32(&power->accumulator);
 		break;
 	case 3:
-		val = get_unaligned_be16(&power->value) * 1000000;
+		val = get_unaligned_be16(&power->value) * 1000000ULL;
 		break;
 	}
 
-	return snprintf(buf, PAGE_SIZE - 1, "%u\n", val);
+	return snprintf(buf, PAGE_SIZE - 1, "%llu\n", val);
 }
 
 static ssize_t occ_show_power_2(struct device *dev,
@@ -525,7 +525,7 @@ static ssize_t occ_show_power_2(struct device *dev,
 		val = get_unaligned_be64(&power->accumulator);
 		break;
 	case 3:
-		val = get_unaligned_be16(&power->value) * 1000000;
+		val = get_unaligned_be16(&power->value) * 1000000ULL;
 		break;
 	case 4:
 		val = power->function_id;
@@ -562,7 +562,7 @@ static ssize_t occ_show_power_a0(struct device *dev,
 		val = get_unaligned_be16(&power->system.update_time);
 		break;
 	case 2:
-		val = get_unaligned_be16(&power->system.value) * 1000000;
+		val = get_unaligned_be16(&power->system.value) * 1000000ULL;
 		break;
 	case 3:
 		val = get_unaligned_be32(&power->system.update_tag);
@@ -574,7 +574,7 @@ static ssize_t occ_show_power_a0(struct device *dev,
 		val = get_unaligned_be16(&power->proc.update_time);
 		break;
 	case 6:
-		val = get_unaligned_be16(&power->proc.value) * 1000000;
+		val = get_unaligned_be16(&power->proc.value) * 1000000ULL;
 		break;
 	case 7:
 		val = get_unaligned_be32(&power->proc.update_tag);
@@ -583,7 +583,7 @@ static ssize_t occ_show_power_a0(struct device *dev,
 		val = get_unaligned_be64(&power->proc.accumulator);
 		break;
 	case 9:
-		val = get_unaligned_be16(&power->vdd.value) * 1000000;
+		val = get_unaligned_be16(&power->vdd.value) * 1000000ULL;
 		break;
 	case 10:
 		val = get_unaligned_be32(&power->vdd.update_tag);
@@ -592,7 +592,7 @@ static ssize_t occ_show_power_a0(struct device *dev,
 		val = get_unaligned_be64(&power->vdd.accumulator);
 		break;
 	case 12:
-		val = get_unaligned_be16(&power->vdn.value) * 1000000;
+		val = get_unaligned_be16(&power->vdn.value) * 1000000ULL;
 		break;
 	case 13:
 		val = get_unaligned_be32(&power->vdn.update_tag);
Signature · 1 line
1.8.3.1
Applied
#1 lore raw
Quoted 6 lines · Eddie James

Power values were overflowing INT_MAX when being converted to microwatts, even though the storage was sufficiently large (unsigned 64 bit). Change literals to unsigned long long. Also change tmep storage to u32 to avoid overflows at 65000 millidegrees.

Applied to dev-4.10.

Cheers,

Joel