hwmon: (lm77) Prevent overflow problem when writing large limits
PATCH 1/2 hwmon: (lm77) Prevent overflow problem when writing large limits
On platforms with sizeof(int) < sizeof(long), writing a temperature limit larger than MAXINT will result in unpredictable limit values written to the chip. Avoid auto-conversion from long to int to fix the problem.
--- drivers/hwmon/lm77.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/lm77.c +1 -1
@@ -78,7 +78,7 @@ struct lm77_data {* In the temperature registers, the low 3 bits are not part of the * temperature values; they are the status bits. */ -static inline s16 LM77_TEMP_TO_REG (int temp) +static inline s16 LM77_TEMP_TO_REG (long temp) {int ntemp =clamp_val (temp,LM77_TEMP_MIN ,LM77_TEMP_MAX );return (ntemp /500 ) *8 ;
Signature · 9 lines
1.9.1 _______________________________________________ lm-sensors mailing list [email protected] http://lists.lm-sensors.org/mailman/listinfo/lm-sensors
Guenter Roeck
maintainerQuoted 16 lines · Axel Lin
On platforms with sizeof(int) < sizeof(long), writing a temperature limit larger than MAXINT will result in unpredictable limit values written to the chip. Avoid auto-conversion from long to int to fix the problem.
Signed-off-by Axel Lin <[email protected]>--- drivers/hwmon/lm77.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/hwmon/lm77.c +0
-0
drivers/hwmon/lm77.c struct lm77_data { · line 84
Quoted 8 lines
drivers/hwmon/lm77.c +1
-1@@ -78,7 +78,7 @@ struct lm77_data {* In the temperature registers, the low 3 bits are not part of the * temperature values; they are the status bits. */ -static inline s16 LM77_TEMP_TO_REG (int temp) +static inline s16 LM77_TEMP_TO_REG (long temp) {int ntemp =clamp_val (temp,LM77_TEMP_MIN ,LM77_TEMP_MAX );return (ntemp /500 ) *8 ;
This driver is way more broken than that. Looking into the code, the following is typical.
data->temp[nr] = val;
lm77_write_value(client, temp_regs[nr], LM77_TEMP_TO_REG(val));This means the clamp is only applied after the value is already stored. Sure, that will "fix" itself after the next register update cycle, but it is still wrong.
Easy fix might be to set 'valid' to 0 instead of writing data->temp[]. But writing the hysteresis value is bad even in this case, since its calculation is also prone to overflows.
Guenter
_______________________________________________
lm-sensors mailing list
[email protected]
http://lists.lm-sensors.org/mailman/listinfo/lm-sensors