[PATCH] hwmon: (dell-smm) overflow check during multiplication

[PATCH] hwmon: (dell-smm) overflow check during multiplication

[Alexandr Sapozhnikov]

Added overflow checking when multiplying int by int and writing the result 
to long to prevent data corruption due to overflow.

Fixes: b1986c8e31a3 ("hwmon: (dell-smm) Add support for fanX_min, fanX_max and fanX_target")
Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
---
 drivers/hwmon/dell-smm-hwmon.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index 1572b5416015..ee2fe651c07f 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -34,6 +34,7 @@
 #include <linux/thermal.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
+#include <linux/limits.h>
 
 #include <linux/i8k.h>
 
@@ -736,6 +737,11 @@ static umode_t dell_smm_is_visible(const void *drvdata, enum hwmon_sensor_types
 	return 0;
 }
 
+static int dell_smm_check_overflow(int a, int b)
+{
+	return (long long)a * (long long)b > LONG_MAX;
+}
+
 static int dell_smm_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, int channel,
 			 long *val)
 {
@@ -769,12 +775,17 @@ static int dell_smm_read(struct device *dev, enum hwmon_sensor_types type, u32 a
 
 			return 0;
 		case hwmon_fan_min:
+			if (dell_smm_check_overflow(data->fan_nominal_speed[channel][0], mult)
+				return -EINVAL;
 			*val = data->fan_nominal_speed[channel][0] * mult;
 
 			return 0;
 		case hwmon_fan_max:
+			if (dell_smm_check_overflow(
+			    data->fan_nominal_speed[channel][data->i8k_fan_max], mult)
+				return -EINVAL;
 			*val = data->fan_nominal_speed[channel][data->i8k_fan_max] * mult;
-
+
 			return 0;
 		case hwmon_fan_target:
 			ret = i8k_get_fan_status(data, channel);
@@ -784,6 +795,8 @@ static int dell_smm_read(struct device *dev, enum hwmon_sensor_types type, u32 a
 			if (ret > data->i8k_fan_max)
 				ret = data->i8k_fan_max;
 
+			if (dell_smm_check_overflow(data->fan_nominal_speed[channel][ret], mult)
+				return -EINVAL;
 			*val = data->fan_nominal_speed[channel][ret] * mult;
 
 			return 0;
-- 
2.51.0

Re: [PATCH] hwmon: (dell-smm) overflow check during multiplication

[Guenter Roeck]

On Mon, Nov 10, 2025 at 06:22:41PM +0300, Alexandr Sapozhnikov wrote:
> Added overflow checking when multiplying int by int and writing the result 
> to long to prevent data corruption due to overflow.
> 

So when / how would this ever overflow ? The nominal speed is guaranteed
to be <= 65,535, and the multiplier is either 1 or 30 or configured by a
module parameter. That means it must be set to an outrageous value on
purpose to trigger the overflow. This is not worth a runtime check.
Add a validation to the probe function instead, and refuse to load the
driver if the user specified an unreasonable value (such as anything
>= 65,536).

Thanks,
Guenter