[PATCH] hwmon: (dell-smm) overflow check during multiplication

[Alexandr Sapozhnikov]

Added overflow checking when multiplying int by int and writing the result 
to long to prevent data corruption due to overflow.

Fixes: b1986c8e31a3 ("hwmon: (dell-smm) Add support for fanX_min, fanX_max and fanX_target")
Signed-off-by: Alexandr Sapozhnikov <alsp705@xxxxxxxxx>
---
 drivers/hwmon/dell-smm-hwmon.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index 1572b5416015..ee2fe651c07f 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -34,6 +34,7 @@
 #include <linux/thermal.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
+#include <linux/limits.h>
 
 #include <linux/i8k.h>
 
@@ -736,6 +737,11 @@ static umode_t dell_smm_is_visible(const void *drvdata, enum hwmon_sensor_types
 	return 0;
 }
 
+static int dell_smm_check_overflow(int a, int b)
+{
+	return (long long)a * (long long)b > LONG_MAX;
+}
+
 static int dell_smm_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, int channel,
 			 long *val)
 {
@@ -769,12 +775,17 @@ static int dell_smm_read(struct device *dev, enum hwmon_sensor_types type, u32 a
 
 			return 0;
 		case hwmon_fan_min:
+			if (dell_smm_check_overflow(data->fan_nominal_speed[channel][0], mult)
+				return -EINVAL;
 			*val = data->fan_nominal_speed[channel][0] * mult;
 
 			return 0;
 		case hwmon_fan_max:
+			if (dell_smm_check_overflow(
+			    data->fan_nominal_speed[channel][data->i8k_fan_max], mult)
+				return -EINVAL;
 			*val = data->fan_nominal_speed[channel][data->i8k_fan_max] * mult;
-
+
 			return 0;
 		case hwmon_fan_target:
 			ret = i8k_get_fan_status(data, channel);
@@ -784,6 +795,8 @@ static int dell_smm_read(struct device *dev, enum hwmon_sensor_types type, u32 a
 			if (ret > data->i8k_fan_max)
 				ret = data->i8k_fan_max;
 
+			if (dell_smm_check_overflow(data->fan_nominal_speed[channel][ret], mult)
+				return -EINVAL;
 			*val = data->fan_nominal_speed[channel][ret] * mult;
 
 			return 0;
-- 
2.51.0