[PATCH] hwmon: (ltc4282) Fix reading the minimum alarm voltage

[PATCH] hwmon: (ltc4282) Fix reading the minimum alarm voltage

[Guenter Roeck]

Coverity reports an out-of-bounds access when reading the minimum alarm
voltage for the VGPIO channel. Add the missing return statement to fix
the problem.

Fixes: cbc29538dbf7 ("hwmon: Add driver for LTC4282")
Cc: Nuno Sa <nuno.sa@analog.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
Sashiko is likely to report a potential overflow in
ltc4282_set_max_limits(). That will need to be fixed in a separate
patch.

 drivers/hwmon/ltc4282.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/ltc4282.c b/drivers/hwmon/ltc4282.c
index 39b9d3abca99..cc698803f8bf 100644
--- a/drivers/hwmon/ltc4282.c
+++ b/drivers/hwmon/ltc4282.c
@@ -374,8 +374,8 @@ static int ltc4282_read_in(struct ltc4282_state *st, u32 attr, long *val,
 						   channel, val);
 	case hwmon_in_min_alarm:
 		if (channel == LTC4282_CHAN_VGPIO)
-			ltc4282_read_alarm(st, LTC4282_ADC_ALERT_LOG,
-					   LTC4282_GPIO_ALARM_L_MASK, val);
+			return ltc4282_read_alarm(st, LTC4282_ADC_ALERT_LOG,
+						  LTC4282_GPIO_ALARM_L_MASK, val);
 
 		return ltc4282_vdd_source_read_alm(st,
 						   LTC4282_VSOURCE_ALARM_L_MASK,
-- 
2.45.2

Re: [PATCH] hwmon: (ltc4282) Fix reading the minimum alarm voltage

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Calculation of `st->power_max` causes a 32-bit integer overflow, resulting in a severely truncated max power limit being written to the device.
--

--- Patch [1]: [PATCH] hwmon: (ltc4282) Fix reading the minimum alarm voltage ---
commit 42cce0899ae28102bd89120aefb684af52579bfe
Author: Guenter Roeck <linux@roeck-us.net>

hwmon: (ltc4282) Fix reading the minimum alarm voltage

Coverity reports an out-of-bounds access when reading the minimum alarm
voltage for the VGPIO channel. Add the missing return statement to fix
the problem.

Fixes: cbc29538dbf7 ("hwmon: Add driver for LTC4282")
Cc: Nuno Sa <nuno.sa@analog.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

> diff --git a/drivers/hwmon/ltc4282.c b/drivers/hwmon/ltc4282.c
> index 39b9d3abca990..cc698803f8bf8 100644
> --- a/drivers/hwmon/ltc4282.c
> +++ b/drivers/hwmon/ltc4282.c
[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential 32-bit
integer overflow in ltc4282_set_max_limits() during device probe:

drivers/hwmon/ltc4282.c:ltc4282_set_max_limits() {
    ...
	/* Power is given by ISENSE * Vout. */
	st->power_max = DIV_ROUND_CLOSEST(st->vsense_max * DECA * MILLI, st->rsense) * st->vfs_out;
	ret = ltc4282_write_power_byte(st, LTC4282_POWER_MAX, st->power_max);
    ...
}

Because the result of DIV_ROUND_CLOSEST() and st->vfs_out are both 32-bit
or smaller types, does this multiplication overflow 32-bit precision before
being assigned to st->power_max? 

If the device tree configures a small sense resistor (e.g., 100 nOhm,
making st->rsense = 1) and the voltage is high, the division result can be
around 343,750,000 and st->vfs_out can be 33,280. The resulting product is
over 11.44 trillion, which would overflow a 32-bit integer. 

Could this cause a severely truncated max power limit to be written to the
hardware, potentially triggering spurious power-bad faults or shutting down
the monitored power rail?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725215755.1926830-1-linux@roeck-us.net?part=1