Patch "hwmon: (max6697) Fix underflow when writing limit attributes" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    hwmon: (max6697) Fix underflow when writing limit attributes

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hwmon-max6697-fix-underflow-when-writing-limit-attri.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b3b1554c3d19eb6f2fe04da4ef2c7f39a37bdc0f
Author: Guenter Roeck <linux@xxxxxxxxxxxx>
Date:   Sat Jul 13 14:26:19 2024 -0700

    hwmon: (max6697) Fix underflow when writing limit attributes
    
    [ Upstream commit cbf7467828cd4ec7ceac7a8b5b5ddb2f69f07b0e ]
    
    Using DIV_ROUND_CLOSEST() on an unbound value can result in underflows.
    Indeed, module test scripts report:
    
    temp1_max: Suspected underflow: [min=0, read 255000, written -9223372036854775808]
    temp1_crit: Suspected underflow: [min=0, read 255000, written -9223372036854775808]
    
    Fix by introducing an extra set of clamping.
    
    Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles")
    Reviewed-by: Tzung-Bi Shih <tzungbi@xxxxxxxxxx>
    Signed-off-by: Guenter Roeck <linux@xxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c
index 2895cea541934..563e73f071d07 100644
--- a/drivers/hwmon/max6697.c
+++ b/drivers/hwmon/max6697.c
@@ -312,6 +312,7 @@ static ssize_t temp_store(struct device *dev,
 		return ret;
 
 	mutex_lock(&data->update_lock);
+	temp = clamp_val(temp, -1000000, 1000000);	/* prevent underflow */
 	temp = DIV_ROUND_CLOSEST(temp, 1000) + data->temp_offset;
 	temp = clamp_val(temp, 0, data->type == max6581 ? 255 : 127);
 	data->temp[nr][index] = temp;




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux