[PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

[Zhu Jun]

temp_auto_temp_off_store() subtracts an unrestricted long from the zone
limit before clamping the resulting hysteresis. Extreme inputs can
overflow this subtraction and select the wrong end of the hysteresis
range.

Bound the requested stop temperature before calculating the difference.
A signed 8-bit zone limit and a maximum hysteresis of 15 degrees require
only the -143..127 degree range.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Zhu Jun <zhujun2@xxxxxxxxxxxxxxxxxxxx>
---
 drivers/hwmon/lm85.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 80bd1f47114d..e776ec4ae40f 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1153,6 +1153,7 @@ static ssize_t temp_auto_temp_off_store(struct device *dev,
 
 	mutex_lock(&data->update_lock);
 	min = TEMP_FROM_REG(data->zone[nr].limit);
+	val = clamp_val(val, -128000 - 15000, 127000);
 	data->zone[nr].hyst = HYST_TO_REG(min - val);
 	if (nr == 0 || nr == 1) {
 		lm85_write_value(client, LM85_REG_AFAN_HYST1,
-- 
2.51.0