[PATCH] hwmon: (it87) Bound 16-bit fan limits before conversion

[Zhu Jun]

FAN16_TO_REG() doubles an unrestricted positive long and adds 1350000
before dividing. Large fan limits can overflow these intermediate values
and select an incorrect tachometer limit. Converting LONG_MAX can select
0xfffe instead of 1.

Apply the same RPM bound used by the 8-bit conversion before doing the
arithmetic. Keep zero as the alarm-disable value.

Fixes: 17d648bf5786 ("it87: Add support for the IT8716F")
---
Validation: x86-64 and i386 driver objects built with W=1.
Source-extracted boundary tests passed on both word sizes;
the corresponding test fails on the base revision. I/O is mocked.
No physical sensor or booted-kernel testing was available.
OpenAI Codex assisted analysis, code, tests and changelog drafting.
Please review and add your own Signed-off-by before submitting.

 drivers/hwmon/it87.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index bbb3f9788c2e..b8ad1ed043b3 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -761,6 +761,7 @@ static inline u16 FAN16_TO_REG(long rpm)
 {
 	if (rpm == 0)
 		return 0xffff;
+	rpm = clamp_val(rpm, 1, 1000000);
 	return clamp_val((1350000 + rpm) / (rpm * 2), 1, 0xfffe);
 }
 

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.51.0