Re: [PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

From: Guenter Roeck

Date: Wed Nov 11 2026 - 12:10:47 EST


On 11/10/26 22:53, Zhu Jun wrote:
temp_auto_temp_off_store() subtracts an unrestricted long from the zone
limit before clamping the resulting hysteresis. Extreme inputs can
overflow this subtraction and select the wrong end of the hysteresis
range.

Bound the requested stop temperature before calculating the difference.
A signed 8-bit zone limit and a maximum hysteresis of 15 degrees require
only the -143..127 degree range.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Zhu Jun <zhujun2@xxxxxxxxxxxxxxxxxxxx>

I honestly can't say if you are trying to annoy me or just don't care.
This is version 2 of this patch. It should have been versioned as such,
and a change log should have been provided.

On top of that, you are flooding me with similar patches which are all
not versioned, and there is no change log. Do you seriously expect me
to dig through all your patches and path versions to figure out what
if anything (besides the added Signed-off-by: tag) changed ?

Guenter

---
drivers/hwmon/lm85.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 80bd1f47114d..e776ec4ae40f 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1153,6 +1153,7 @@ static ssize_t temp_auto_temp_off_store(struct device *dev,
mutex_lock(&data->update_lock);
min = TEMP_FROM_REG(data->zone[nr].limit);
+ val = clamp_val(val, -128000 - 15000, 127000);
data->zone[nr].hyst = HYST_TO_REG(min - val);
if (nr == 0 || nr == 1) {
lm85_write_value(client, LM85_REG_AFAN_HYST1,