Re: [PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

[Guenter Roeck]

On 11/9/26 02:19, Zhu Jun wrote:
> temp_auto_temp_off_store() subtracts an unrestricted long from the zone
> limit before clamping the resulting hysteresis. Extreme inputs can
> overflow this subtraction and select the wrong end of the hysteresis
> range.
>
> Bound the requested stop temperature before calculating the difference.
> A signed 8-bit zone limit and a maximum hysteresis of 15 degrees require
> only the -143..127 degree range.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> ---
> Validation: x86-64 and i386 driver objects built with W=1.
> Source-extracted boundary tests passed on both word sizes;
> the corresponding test fails on the base revision. I/O is mocked.
> No physical sensor or booted-kernel testing was available.
> OpenAI Codex assisted analysis, code, tests and changelog drafting.
> Please review and add your own Signed-off-by before submitting.

You did not even read that, did you ? I can not apply any of your patches
due to the missing signature.

Guenter

>   drivers/hwmon/lm85.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
> index 80bd1f47114d..e776ec4ae40f 100644
> --- a/drivers/hwmon/lm85.c
> +++ b/drivers/hwmon/lm85.c
> @@ -1153,6 +1153,7 @@ static ssize_t temp_auto_temp_off_store(struct device *dev,
>   
>   	mutex_lock(&data->update_lock);
>   	min = TEMP_FROM_REG(data->zone[nr].limit);
> +	val = clamp_val(val, -128000 - 15000, 127000);
>   	data->zone[nr].hyst = HYST_TO_REG(min - val);
>   	if (nr == 0 || nr == 1) {
>   		lm85_write_value(client, LM85_REG_AFAN_HYST1,
>
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb