diff options
| author | Axel Lin <axel.lin@ingics.com> | 2014-07-31 16:58:04 +0200 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2014-07-31 18:41:46 +0200 |
| commit | 99765db299f0b07093318395f789a716ed23fc95 (patch) | |
| tree | 0b61ca3e3fed886c05bfe4b0b51e332268e488a2 /drivers | |
| parent | hwmon: (amc6821) Fix possible race condition bug (diff) | |
| download | linux-99765db299f0b07093318395f789a716ed23fc95.tar.xz linux-99765db299f0b07093318395f789a716ed23fc95.zip | |
hwmon: (lm77) Prevent overflow problem when writing large limits
On platforms with sizeof(int) < sizeof(long), writing a temperature
limit larger than MAXINT will result in unpredictable limit values
written to the chip.
Clamp the input values to the supported limits first to fix the problem.
For set_temp_hyst:
As Guenter pointed out that the temperature is read as unsigned and stored in
an unsigned long. This is wrong; nothing in the datasheet suggests that the
value (the absolute temperature) must be positive.
So change it to signed.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to '')
| -rw-r--r-- | drivers/hwmon/lm77.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/hwmon/lm77.c b/drivers/hwmon/lm77.c index 5ceb443b938d..69b05cc2f60e 100644 --- a/drivers/hwmon/lm77.c +++ b/drivers/hwmon/lm77.c @@ -80,8 +80,7 @@ struct lm77_data { */ static inline s16 LM77_TEMP_TO_REG(int temp) { - int ntemp = clamp_val(temp, LM77_TEMP_MIN, LM77_TEMP_MAX); - return (ntemp / 500) * 8; + return (temp / 500) * 8; } static inline int LM77_TEMP_FROM_REG(s16 reg) @@ -175,6 +174,7 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *devattr, if (err) return err; + val = clamp_val(val, LM77_TEMP_MIN, LM77_TEMP_MAX); mutex_lock(&data->update_lock); data->temp[nr] = val; lm77_write_value(client, temp_regs[nr], LM77_TEMP_TO_REG(val)); @@ -192,15 +192,16 @@ static ssize_t set_temp_hyst(struct device *dev, { struct lm77_data *data = dev_get_drvdata(dev); struct i2c_client *client = data->client; - unsigned long val; + long val; int err; - err = kstrtoul(buf, 10, &val); + err = kstrtol(buf, 10, &val); if (err) return err; mutex_lock(&data->update_lock); - data->temp[t_hyst] = data->temp[t_crit] - val; + val = clamp_val(data->temp[t_crit] - val, LM77_TEMP_MIN, LM77_TEMP_MAX); + data->temp[t_hyst] = val; lm77_write_value(client, LM77_REG_TEMP_HYST, LM77_TEMP_TO_REG(data->temp[t_hyst])); mutex_unlock(&data->update_lock); |