[PATCH] hwmon: (w83627hf) Clamp VRM9 voltage limits before subtracting

[Zhu Jun]

From: zhujun <zhujun2@xxxxxxxxxxxxxxxxxxxx>

The VRM9 limit conversion subtracts the 700 mV offset from an unsigned
value before clamping. Writing zero to in0_min or in0_max therefore
selects register 255 instead of zero. Multiplication can also wrap for
large inputs.

Bound the input before applying the VRM9 conversion. The chosen bounds
cover the full register range and keep the arithmetic within range.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
---
Validation: x86-64 and i386 driver objects built with W=1.
Source-extracted boundary tests passed on 32-bit and 64-bit;
the corresponding test fails on the base revision. I/O is mocked.
No physical sensor hardware or booted-kernel test was available.
OpenAI Codex assisted analysis, code, tests and changelog drafting.
The human submitter must review and add their Signed-off-by.

 drivers/hwmon/w83627hf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
index a26f4cdfb8e2..3ebb41db5033 100644
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -853,7 +853,7 @@ static ssize_t in0_min_store(struct device *dev,
 
 		/* use VRM9 calculation */
 		data->in_min[0] =
-			clamp_val(((val * 100) - 70000 + 244) / 488, 0, 255);
+			clamp_val((clamp_val(val, 700, 2000) * 100 - 70000 + 244) / 488, 0, 255);
 	else
 		/* use VRM8 (standard) calculation */
 		data->in_min[0] = IN_TO_REG(val);
@@ -892,7 +892,7 @@ static ssize_t in0_max_store(struct device *dev,
 		
 		/* use VRM9 calculation */
 		data->in_max[0] =
-			clamp_val(((val * 100) - 70000 + 244) / 488, 0, 255);
+			clamp_val((clamp_val(val, 700, 2000) * 100 - 70000 + 244) / 488, 0, 255);
 	else
 		/* use VRM8 (standard) calculation */
 		data->in_max[0] = IN_TO_REG(val);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.51.0