Patch "hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes" has been added to the 3.18-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
hwmon-gl520sm-fix-overflows-and-crash-seen-when-writing-into-limit-attributes.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From foo@baz Thu Oct 5 10:58:04 CEST 2017
From: Guenter Roeck <[email protected]>
Date: Tue, 27 Dec 2016 14:15:07 -0800
Subject: hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes
From: Guenter Roeck <[email protected]>
[ Upstream commit 87cdfa9d60f4f40e6d71b04b10b36d9df3c89282 ]
Writes into limit attributes can overflow due to multplications and additions with unbound input values. Writing into fan limit attributes can result in a crash with a division by zero if very large values are written and the fan divider is larger than 1.
--- drivers/hwmon/gl520sm.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/hwmon/gl520sm.c +17 -10
@@ -208,11 +208,13 @@ static ssize_t get_cpu_vid(struct device } static DEVICE_ATTR(cpu0_vid, S_IRUGO, get_cpu_vid, NULL); -#define VDD_FROM_REG (val) (((val) * 95 + 2) / 4) -#define VDD_TO_REG (val) clamp_val((((val) * 4 + 47) / 95), 0, 255) - -#define IN_FROM_REG (val) ((val) * 19) -#define IN_TO_REG (val) clamp_val((((val) + 9) / 19), 0, 255) +#define VDD_FROM_REG (val) DIV_ROUND_CLOSEST((val) * 95, 4) +#define VDD_CLAMP (val) clamp_val(val, 0, 255 * 95 / 4) +#define VDD_TO_REG (val) DIV_ROUND_CLOSEST(VDD_CLAMP(val) * 4, 95) + +#define IN_FROM_REG (val) ((val) * 19) +#define IN_CLAMP (val) clamp_val(val, 0, 255 * 19) +#define IN_TO_REG (val) DIV_ROUND_CLOSEST(IN_CLAMP(val), 19)static ssize_t get_in_input (struct device *dev,struct device_attribute *attr,char *buf)
@@ -349,8 +351,13 @@ static SENSOR_DEVICE_ATTR(in4_max, S_IRU#define DIV_FROM_REG (val) (1 << (val))#define FAN_FROM_REG (val, div) ((val) == 0 ? 0 : (480000 / ((val) << (div)))) -#define FAN_TO_REG (val, div) ((val) <= 0 ? 0 : \ - clamp_val((480000 + ((val) << ((div)-1))) / ((val) << (div)), 1, 255)) + +#define FAN_BASE (div) (480000 >> (div)) +#define FAN_CLAMP (val, div) clamp_val(val, FAN_BASE(div) / 255, \ + FAN_BASE(div)) +#define FAN_TO_REG (val, div) ((val) == 0 ? 0 : \ + DIV_ROUND_CLOSEST(480000, \ + FAN_CLAMP(val, div) << (div)))static ssize_t get_fan_input (struct device *dev,struct device_attribute *attr,char *buf)
@@ -513,9 +520,9 @@ static SENSOR_DEVICE_ATTR(fan2_div, S_IR static DEVICE_ATTR(fan1_off, S_IRUGO | S_IWUSR, get_fan_off, set_fan_off); -#define TEMP_FROM_REG (val) (((val) - 130) * 1000) -#define TEMP_TO_REG (val) clamp_val(((((val) < 0 ? \ - (val) - 500 : (val) + 500) / 1000) + 130), 0, 255) +#define TEMP_FROM_REG (val) (((val) - 130) * 1000) +#define TEMP_CLAMP (val) clamp_val(val, -130000, 125000) +#define TEMP_TO_REG (val) (DIV_ROUND_CLOSEST(TEMP_CLAMP(val), 1000) + 130)static ssize_t get_temp_input (struct device *dev,struct device_attribute *attr,char *buf)
Patches currently in stable-queue which might be from [email protected] are
queue-3.18/hwmon-gl520sm-fix-overflows-and-crash-seen-when-writing-into-limit-attributes.patch