[PATCH] hwmon: (sht3x) Fix overflow when writing alert limits

[PATCH] hwmon: (sht3x) Fix overflow when writing alert limits

[Wayne Ho]

limit_write() encodes the limits with 32-bit arithmetic, which overflows
for the largest accepted values:

  (130000 + 45000) * 24543 = 4295025000 > U32_MAX
  100000 * 42950           = 4295000000 > U32_MAX

Writing 130000 to temp1_max therefore programs -45 degrees C, and
writing 100000 to humidity1_max programs 0 %RH, so a limit set to its
maximum makes the alert fire instead of never firing. Reading the
attributes back returns the cached values, so this is not visible from
sysfs.

Use 64-bit arithmetic and clamp each result to its field width. Even
with 64-bit arithmetic, 130000 encodes to 0x200, which overflows the
9-bit temperature field, and 100000 encodes to 0x10000, which is still 0
after masking.

Prepared with the help of an AI coding assistant (Claude); I reproduced
the bug and tested the fix on hardware.

Fixes: 7c84f7f80d6f ("hwmon: add support for Sensirion SHT3x sensors")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-hwmon/20260725222229.EA69B1F000E9@smtp.kernel.org/
Signed-off-by: Wayne Ho <wayneho219@gmail.com>
---

Notes:
    Tested on an STM32MP215F-DK (SHT30) with this change backported to a
    v6.6 based kernel, reading the high alert set limit register (0xE11F)
    back with i2ctransfer (before -> after):
    
      humidity1_max = 100000                          0x0133 -> 0xff33
      temp1_max = 130000 (humidity1_max is 100000)    0x0000 -> 0xffff
    
    All other accepted values encode as before (checked exhaustively in
    userspace). On hwmon-next, this was build-tested only.

 drivers/hwmon/sht3x.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/sht3x.c b/drivers/hwmon/sht3x.c
index 866e9113f..68ab1cf1e 100644
--- a/drivers/hwmon/sht3x.c
+++ b/drivers/hwmon/sht3x.c
@@ -388,8 +388,8 @@ static size_t limit_write(struct device *dev,
 	 * adapted for fixed point arithmetic and packed the same as
 	 * in limit_read()
 	 */
-	raw = ((u32)(temperature + 45000) * 24543) >> (16 + 7);
-	raw |= ((humidity * 42950) >> 16) & 0xfe00;
+	raw = min(((u64)(temperature + 45000) * 24543) >> (16 + 7), 0x1ff);
+	raw |= min(((u64)humidity * 42950) >> 16, 0xffff) & 0xfe00;
 
 	put_unaligned_be16(raw, position);
 	position += SHT3X_WORD_LEN;
-- 
2.43.0

Re: [PATCH] hwmon: (sht3x) Fix overflow when writing alert limits

[sashiko-bot]

> limit_write() encodes the limits with 32-bit arithmetic, which overflows
> for the largest accepted values:
> 
>   (130000 + 45000) * 24543 = 4295025000 > U32_MAX
>   100000 * 42950           = 4295000000 > U32_MAX
> 
> Writing 130000 to temp1_max therefore programs -45 degrees C, and
> writing 100000 to humidity1_max programs 0 %RH, so a limit set to its
> maximum makes the alert fire instead of never firing. Reading the
> attributes back returns the cached values, so this is not visible from
> sysfs.
> 
> Use 64-bit arithmetic and clamp each result to its field width. Even
> with 64-bit arithmetic, 130000 encodes to 0x200, which overflows the
> 9-bit temperature field, and 100000 encodes to 0x10000, which is still 0
> after masking.
> 
> Prepared with the help of an AI coding assistant (Claude); I reproduced
> the bug and tested the fix on hardware.
> 
> Fixes: 7c84f7f80d6f ("hwmon: add support for Sensirion SHT3x sensors")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/linux-hwmon/20260725222229.EA69B1F000E9@smtp.kernel.org/
> Signed-off-by: Wayne Ho <wayneho219@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113054857.97048-1-wayneho219@gmail.com?part=1