summaryrefslogtreecommitdiffstats
path: root/drivers/hwmon/lm77.c
diff options
context:
space:
mode:
authorAxel Lin <axel.lin@ingics.com>2014-07-31 16:58:04 +0200
committerGuenter Roeck <linux@roeck-us.net>2014-07-31 18:41:46 +0200
commit99765db299f0b07093318395f789a716ed23fc95 (patch)
tree0b61ca3e3fed886c05bfe4b0b51e332268e488a2 /drivers/hwmon/lm77.c
parenthwmon: (amc6821) Fix possible race condition bug (diff)
downloadlinux-99765db299f0b07093318395f789a716ed23fc95.tar.xz
linux-99765db299f0b07093318395f789a716ed23fc95.zip
hwmon: (lm77) Prevent overflow problem when writing large limits
On platforms with sizeof(int) < sizeof(long), writing a temperature limit larger than MAXINT will result in unpredictable limit values written to the chip. Clamp the input values to the supported limits first to fix the problem. For set_temp_hyst: As Guenter pointed out that the temperature is read as unsigned and stored in an unsigned long. This is wrong; nothing in the datasheet suggests that the value (the absolute temperature) must be positive. So change it to signed. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to '')
-rw-r--r--drivers/hwmon/lm77.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/hwmon/lm77.c b/drivers/hwmon/lm77.c
index 5ceb443b938d..69b05cc2f60e 100644
--- a/drivers/hwmon/lm77.c
+++ b/drivers/hwmon/lm77.c
@@ -80,8 +80,7 @@ struct lm77_data {
*/
static inline s16 LM77_TEMP_TO_REG(int temp)
{
- int ntemp = clamp_val(temp, LM77_TEMP_MIN, LM77_TEMP_MAX);
- return (ntemp / 500) * 8;
+ return (temp / 500) * 8;
}
static inline int LM77_TEMP_FROM_REG(s16 reg)
@@ -175,6 +174,7 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *devattr,
if (err)
return err;
+ val = clamp_val(val, LM77_TEMP_MIN, LM77_TEMP_MAX);
mutex_lock(&data->update_lock);
data->temp[nr] = val;
lm77_write_value(client, temp_regs[nr], LM77_TEMP_TO_REG(val));
@@ -192,15 +192,16 @@ static ssize_t set_temp_hyst(struct device *dev,
{
struct lm77_data *data = dev_get_drvdata(dev);
struct i2c_client *client = data->client;
- unsigned long val;
+ long val;
int err;
- err = kstrtoul(buf, 10, &val);
+ err = kstrtol(buf, 10, &val);
if (err)
return err;
mutex_lock(&data->update_lock);
- data->temp[t_hyst] = data->temp[t_crit] - val;
+ val = clamp_val(data->temp[t_crit] - val, LM77_TEMP_MIN, LM77_TEMP_MAX);
+ data->temp[t_hyst] = val;
lm77_write_value(client, LM77_REG_TEMP_HYST,
LM77_TEMP_TO_REG(data->temp[t_hyst]));
mutex_unlock(&data->update_lock);