hwmon: (emcw201) Fix overflows seen when writing into limit attributes
Writes into temperature and voltage limit attributes can overflow due to multiplications with unchecked parameters. Also, the input parameter to DIV_ROUND_CLOSEST() needis to be range checked. Reviewed-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Guenter Roeck <linux@roeck-us.net>zero-colors
parent
ca1b10b825
commit
59715f4d16
|
@ -215,12 +215,13 @@ static ssize_t set_in(struct device *dev, struct device_attribute *devattr,
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
val = DIV_ROUND_CLOSEST(val * 0xC0, nominal_mv[nr]);
|
val = clamp_val(val, 0, 255 * nominal_mv[nr] / 192);
|
||||||
|
val = DIV_ROUND_CLOSEST(val * 192, nominal_mv[nr]);
|
||||||
reg = (sf == min) ? EMC6W201_REG_IN_LOW(nr)
|
reg = (sf == min) ? EMC6W201_REG_IN_LOW(nr)
|
||||||
: EMC6W201_REG_IN_HIGH(nr);
|
: EMC6W201_REG_IN_HIGH(nr);
|
||||||
|
|
||||||
mutex_lock(&data->update_lock);
|
mutex_lock(&data->update_lock);
|
||||||
data->in[sf][nr] = clamp_val(val, 0, 255);
|
data->in[sf][nr] = val;
|
||||||
err = emc6w201_write8(client, reg, data->in[sf][nr]);
|
err = emc6w201_write8(client, reg, data->in[sf][nr]);
|
||||||
mutex_unlock(&data->update_lock);
|
mutex_unlock(&data->update_lock);
|
||||||
|
|
||||||
|
@ -252,12 +253,13 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *devattr,
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
|
val = clamp_val(val, -127000, 127000);
|
||||||
val = DIV_ROUND_CLOSEST(val, 1000);
|
val = DIV_ROUND_CLOSEST(val, 1000);
|
||||||
reg = (sf == min) ? EMC6W201_REG_TEMP_LOW(nr)
|
reg = (sf == min) ? EMC6W201_REG_TEMP_LOW(nr)
|
||||||
: EMC6W201_REG_TEMP_HIGH(nr);
|
: EMC6W201_REG_TEMP_HIGH(nr);
|
||||||
|
|
||||||
mutex_lock(&data->update_lock);
|
mutex_lock(&data->update_lock);
|
||||||
data->temp[sf][nr] = clamp_val(val, -127, 127);
|
data->temp[sf][nr] = val;
|
||||||
err = emc6w201_write8(client, reg, data->temp[sf][nr]);
|
err = emc6w201_write8(client, reg, data->temp[sf][nr]);
|
||||||
mutex_unlock(&data->update_lock);
|
mutex_unlock(&data->update_lock);
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue