Re: [PATCH 1/2] hwmon: (dell-smm) Clamp the pwm value before scaling it

[Guenter Roeck]

On Fri, Nov 13, 2026 at 10:20:22PM -0800, Rosen Penev wrote:
> dell_smm_write() scales the value written to pwmN with
> 
> 	DIV_ROUND_CLOSEST(val, data->i8k_pwm_mult)
> 
> before clamping the result to the valid fan states. The rounding adds
> i8k_pwm_mult / 2 to val first, which overflows for values near
> LONG_MAX and wraps to a large negative number. That is then clamped to
> 0, so writing a huge value turns the fan off instead of running it at
> the highest speed. With the default fan_max of 2, writing any value
> from LONG_MAX - 63 up to LONG_MAX selects fan state 0.
> 
> Clamp val to the pwm range of 0 to 255 first.
> 
> Fixes: e7f5f275c62a ("i8k: Implement hwmon based fan speed control")
> Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>
> ---
>  drivers/hwmon/dell-smm-hwmon.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
> index 5ec487843faa..e8b4e8a29e8b 100644
> --- a/drivers/hwmon/dell-smm-hwmon.c
> +++ b/drivers/hwmon/dell-smm-hwmon.c
> @@ -1030,6 +1030,7 @@ static int dell_smm_write(struct device *dev, enum hwmon_sensor_types type, u32
>  	case hwmon_pwm:
>  		switch (attr) {
>  		case hwmon_pwm_input:
> +			val = clamp_val(val, 0, 255);

Per convention, invalid pwm value writes should return -EINVAL
(because the range is well defined, unlike other limits which
are chip dependent).

Thanks,
Guenter