Re: [PATCH 2/2] hwmon: (dell-smm) Reject a fan_max that the BIOS cannot take

[Guenter Roeck]

On Fri, Nov 13, 2026 at 10:20:23PM -0800, Rosen Penev wrote:
> The fan_max module parameter is used without any range check, unlike
> fan_mult. dell_smm_init_hwmon() allocates the nominal speed table with
> 
> 	devm_kmalloc_array(dev, data->i8k_fan_max + 1, ...)
> 
> and fan_max=4294967295 wraps the count to 0. devm_kmalloc() then
> returns ZERO_SIZE_PTR, which the first successful nominal speed call
> writes through.
> 
> Values above 255 are also meaningless: the fan state is passed to the
> BIOS as fan | (speed << 8), so the higher bits end up in other parts of
> the request. Large values that do not wrap still cost one SMM call per
> state and fan while probing.
> 
> Fail probing if the maximum fan state does not fit in a byte, like the
> existing check for fan_mult.
> 
> Fixes: 81474fc2fae9 ("i8k: Add support for configurable maximum fan speed value")
> Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>

Applied.

Thanks,
Guenter