[PATCH] hwmon: it87: Reject negative values in set_fan()

[Nikita Zhandarovich]

set_fan() parses user input with kstrtol() and passes the resulting
value to FAN16_TO_REG() on chips with 16-bit fan support.

Negative fan speeds are not meaningful and should be rejected before
conversion. Discard val < 0 to keep the conversion in its valid input
domain and avoid invalid arithmetic in the register conversion path.

Worst scenario, one may be able to abuse undefined behaviour of signed
overflow to possibly induce rpm * 2 == 0 in FAN16_TO_REG(), thus
causing a division by zero.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 17d648bf5786 ("it87: Add support for the IT8716F")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@xxxxxxxxxx>
---
 drivers/hwmon/it87.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 5fd310662ee4..888db1975876 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -1412,6 +1412,9 @@ static ssize_t set_fan(struct device *dev, struct device_attribute *attr,
 	if (kstrtol(buf, 10, &val) < 0)
 		return -EINVAL;
 
+	if (val < 0)
+		return -EINVAL;
+
 	err = it87_lock(data);
 	if (err)
 		return err;