This is a note to let you know that I've just added the patch titled
hwmon: (lm92) Prevent overflow problem when writing large limits
to the 3.16-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
hwmon-lm92-prevent-overflow-problem-when-writing-large-limits.patch
and it can be found in the queue-3.16 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5b963089161b8fb244889c972edf553b9d737545 Mon Sep 17 00:00:00 2001
From: Axel Lin <axel.lin@xxxxxxxxxx>
Date: Tue, 5 Aug 2014 10:08:31 +0800
Subject: hwmon: (lm92) Prevent overflow problem when writing large limits
From: Axel Lin <axel.lin@xxxxxxxxxx>
commit 5b963089161b8fb244889c972edf553b9d737545 upstream.
On platforms with sizeof(int) < sizeof(long), writing a temperature
limit larger than MAXINT will result in unpredictable limit values
written to the chip. Avoid auto-conversion from long to int to fix
the problem.
The hysteresis temperature range depends on the value of
data->temp[attr->index], since val is subtracted from it.
Use a wider clamp, [-120000, 220000] should do to cover the
possible range. Also add missing TEMP_TO_REG() on writes into
cached hysteresis value.
Also uses clamp_val to simplify the code a bit.
Signed-off-by: Axel Lin <axel.lin@xxxxxxxxxx>
[Guenter Roeck: Fixed double TEMP_TO_REG on hysteresis updates]
Signed-off-by: Guenter Roeck <linux@xxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/hwmon/lm92.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/drivers/hwmon/lm92.c
+++ b/drivers/hwmon/lm92.c
@@ -74,12 +74,9 @@ static inline int TEMP_FROM_REG(s16 reg)
return reg / 8 * 625 / 10;
}
-static inline s16 TEMP_TO_REG(int val)
+static inline s16 TEMP_TO_REG(long val)
{
- if (val <= -60000)
- return -60000 * 10 / 625 * 8;
- if (val >= 160000)
- return 160000 * 10 / 625 * 8;
+ val = clamp_val(val, -60000, 160000);
return val * 10 / 625 * 8;
}
@@ -206,10 +203,12 @@ static ssize_t set_temp_hyst(struct devi
if (err)
return err;
+ val = clamp_val(val, -120000, 220000);
mutex_lock(&data->update_lock);
- data->temp[t_hyst] = TEMP_FROM_REG(data->temp[attr->index]) - val;
+ data->temp[t_hyst] =
+ TEMP_TO_REG(TEMP_FROM_REG(data->temp[attr->index]) - val);
i2c_smbus_write_word_swapped(client, LM92_REG_TEMP_HYST,
- TEMP_TO_REG(data->temp[t_hyst]));
+ data->temp[t_hyst]);
mutex_unlock(&data->update_lock);
return count;
}
Patches currently in stable-queue which might be from axel.lin@xxxxxxxxxx are
queue-3.16/hwmon-sis5595-prevent-overflow-problem-when-writing-large-limits.patch
queue-3.16/hwmon-ads1015-fix-off-by-one-for-valid-channel-index-checking.patch
queue-3.16/hwmon-lm78-fix-overflow-problems-seen-when-writing-large-temperature-limits.patch
queue-3.16/hwmon-gpio-fan-prevent-overflow-problem-when-writing-large-limits.patch
queue-3.16/hwmon-amc6821-fix-possible-race-condition-bug.patch
queue-3.16/hwmon-ads1015-fix-out-of-bounds-array-access.patch
queue-3.16/hwmon-dme1737-prevent-overflow-problem-when-writing-large-limits.patch
queue-3.16/hwmon-lm92-prevent-overflow-problem-when-writing-large-limits.patch
queue-3.16/hwmon-lm85-fix-various-errors-on-attribute-writes.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html