[PATCH] hwmon: (vt8231) Clamp voltage limits before scaling

[Zhu Jun]

From: zhujun <zhujun2@xxxxxxxxxxxxxxxxxxxx>

The voltage limit stores multiply an unrestricted unsigned long before
clamping the register value. Large inputs can wrap and select a low
threshold. On 32-bit systems, writing 4483265 mV to a regular voltage
limit selects register 3 instead of 255.

Bound the input before multiplication, using the separate scaling for
input 5. This preserves the conversion throughout the representable
range.

Fixes: 1de9e371b89e ("[PATCH] hwmon: New vt8231 driver")
---
Validation: x86-64 and i386 driver objects built with W=1.
Source-extracted boundary tests passed on 32-bit and 64-bit;
the corresponding test fails on the base revision. I/O is mocked.
No physical sensor hardware or booted-kernel test was available.
OpenAI Codex assisted analysis, code, tests and changelog drafting.
The human submitter must review and add their Signed-off-by.

 drivers/hwmon/vt8231.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hwmon/vt8231.c b/drivers/hwmon/vt8231.c
index 1fe361bc30e2..a022119ee305 100644
--- a/drivers/hwmon/vt8231.c
+++ b/drivers/hwmon/vt8231.c
@@ -293,6 +293,7 @@ static ssize_t in_min_store(struct device *dev, struct device_attribute *attr,
 		return err;
 
 	mutex_lock(&data->update_lock);
+	val = min(val, 255UL * 10000 / 958);
 	data->in_min[nr] = clamp_val(((val * 958) / 10000) + 3, 0, 255);
 	vt8231_write_value(data, regvoltmin[nr], data->in_min[nr]);
 	mutex_unlock(&data->update_lock);
@@ -313,6 +314,7 @@ static ssize_t in_max_store(struct device *dev, struct device_attribute *attr,
 		return err;
 
 	mutex_lock(&data->update_lock);
+	val = min(val, 255UL * 10000 / 958);
 	data->in_max[nr] = clamp_val(((val * 958) / 10000) + 3, 0, 255);
 	vt8231_write_value(data, regvoltmax[nr], data->in_max[nr]);
 	mutex_unlock(&data->update_lock);
@@ -360,6 +362,7 @@ static ssize_t in5_min_store(struct device *dev,
 		return err;
 
 	mutex_lock(&data->update_lock);
+	val = min(val, 255UL * 10000 * 54 / (958 * 34));
 	data->in_min[5] = clamp_val(((val * 958 * 34) / (10000 * 54)) + 3,
 				    0, 255);
 	vt8231_write_value(data, regvoltmin[5], data->in_min[5]);
@@ -380,6 +383,7 @@ static ssize_t in5_max_store(struct device *dev,
 		return err;
 
 	mutex_lock(&data->update_lock);
+	val = min(val, 255UL * 10000 * 54 / (958 * 34));
 	data->in_max[5] = clamp_val(((val * 958 * 34) / (10000 * 54)) + 3,
 				    0, 255);
 	vt8231_write_value(data, regvoltmax[5], data->in_max[5]);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.51.0