Re: [PATCH v5 3/4] hwmon: it87: expose additional temperature limits

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Writing to newly exposed `temp4_type`, `temp5_type`, or `temp6_type` attributes results in out-of-bounds bit shifts that silently corrupt the configuration of sensors 1-3.
--

commit 799ba3c032a9c2e42d2a88d4c0b5a095915c09f1
Author: benoit.masson <yahoo@perenite.com>

    hwmon: it87: expose additional temperature limits
    
    Expose extra temp min/max/offset/type/alarm attributes when a chip
    reports more than three temperature resources.

> diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
> index e077adbb30911..e44ec65c76f03 100644
> --- a/drivers/hwmon/it87.c
> +++ b/drivers/hwmon/it87.c

[ ... ]

> @@ -1476,6 +1494,12 @@ static SENSOR_DEVICE_ATTR(temp2_type, S_IRUGO | S_IWUSR, show_temp_type,
>  			  set_temp_type, 1);
>  static SENSOR_DEVICE_ATTR(temp3_type, S_IRUGO | S_IWUSR, show_temp_type,
>  			  set_temp_type, 2);
> +static SENSOR_DEVICE_ATTR(temp4_type, 0644, show_temp_type,
> +			  set_temp_type, 3);
> +static SENSOR_DEVICE_ATTR(temp5_type, 0644, show_temp_type,
> +			  set_temp_type, 4);
> +static SENSOR_DEVICE_ATTR(temp6_type, 0644, show_temp_type,
> +			  set_temp_type, 5);

[Severity: High]
When userspace writes to the newly exposed temp4_type attribute, nr will be 3.
Looking at set_temp_type(), it seems to destructively modify bits belonging to
sensors 1-3 when nr >= 3:

drivers/hwmon/it87.c:set_temp_type() {
    ...
	reg &= ~(1 << nr);
	reg &= ~(8 << nr);
    ...
}

Can this corrupt the configuration for the other sensors?

Additionally, when configuring PECI (val == 6) for temp4_type:

drivers/hwmon/it87.c:set_temp_type() {
    ...
	else if (has_temp_peci(data, nr) && val == 6)
		reg |= (nr + 1) << 6;
    ...
}

Because reg is an 8-bit u8, does (3 + 1) << 6 (which evaluates to 256)
overflow the register limit?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260829170545.33401-1-jerome.tollet@gmail.com?part=3