diff options
| author | Axel Lin <axel.lin@ingics.com> | 2014-08-05 04:08:31 +0200 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2014-08-06 02:48:52 +0200 |
| commit | 5b963089161b8fb244889c972edf553b9d737545 (patch) | |
| tree | d512add2afcc03879f3cb2581a2f5a32db6a0c93 /drivers/hwmon | |
| parent | Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git... (diff) | |
| download | linux-5b963089161b8fb244889c972edf553b9d737545.tar.xz linux-5b963089161b8fb244889c972edf553b9d737545.zip | |
hwmon: (lm92) Prevent overflow problem when writing large limits
On platforms with sizeof(int) < sizeof(long), writing a temperature
limit larger than MAXINT will result in unpredictable limit values
written to the chip. Avoid auto-conversion from long to int to fix
the problem.
The hysteresis temperature range depends on the value of
data->temp[attr->index], since val is subtracted from it.
Use a wider clamp, [-120000, 220000] should do to cover the
possible range. Also add missing TEMP_TO_REG() on writes into
cached hysteresis value.
Also uses clamp_val to simplify the code a bit.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
[Guenter Roeck: Fixed double TEMP_TO_REG on hysteresis updates]
Cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to 'drivers/hwmon')
| -rw-r--r-- | drivers/hwmon/lm92.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/drivers/hwmon/lm92.c b/drivers/hwmon/lm92.c index d2060e245ff5..cfaf70b9cba7 100644 --- a/drivers/hwmon/lm92.c +++ b/drivers/hwmon/lm92.c @@ -74,12 +74,9 @@ static inline int TEMP_FROM_REG(s16 reg) return reg / 8 * 625 / 10; } -static inline s16 TEMP_TO_REG(int val) +static inline s16 TEMP_TO_REG(long val) { - if (val <= -60000) - return -60000 * 10 / 625 * 8; - if (val >= 160000) - return 160000 * 10 / 625 * 8; + val = clamp_val(val, -60000, 160000); return val * 10 / 625 * 8; } @@ -206,10 +203,12 @@ static ssize_t set_temp_hyst(struct device *dev, if (err) return err; + val = clamp_val(val, -120000, 220000); mutex_lock(&data->update_lock); - data->temp[t_hyst] = TEMP_FROM_REG(data->temp[attr->index]) - val; + data->temp[t_hyst] = + TEMP_TO_REG(TEMP_FROM_REG(data->temp[attr->index]) - val); i2c_smbus_write_word_swapped(client, LM92_REG_TEMP_HYST, - TEMP_TO_REG(data->temp[t_hyst])); + data->temp[t_hyst]); mutex_unlock(&data->update_lock); return count; } |