Re: [PATCH v4 7/8] hwmon: Add mutex protecting for sbtsi read/write through hwmon

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Integer overflow in `sbtsi_write` when `ext_range_mode` is enabled, causing large inputs to be incorrectly clamped to minimum.
--

--- Patch [7]: [PATCH v4 7/8] hwmon: Add mutex protecting for sbtsi read/write through hwmon ---
commit 8772051459eabab96983f02f6316165d79c69002
Author: Prathima <Prathima.Lk@amd.com>

hwmon: Add mutex protecting for sbtsi read/write through hwmon

This commit adds a mutex and takes it around SBTSI read/write paths so that
only one transaction runs at a time. The lock is held only for the duration 
of the bus transfer and associated driver bookkeeping.

> diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
> index d7ae986d824c4..11c8108d69b2a 100644
> --- a/drivers/hwmon/sbtsi_temp.c
> +++ b/drivers/hwmon/sbtsi_temp.c
[ ... ]
> @@ -84,6 +85,7 @@ static int sbtsi_temp_write(struct sbtsi_data *data, u8 reg_int, u8 reg_dec,
>  {
>  	int ret;
>  
> +	guard(sbtsi)(data);
>  	ret = sbtsi_xfer(data, reg_int, &val_int, false);
>  	if (!ret)
>  		ret = sbtsi_xfer(data, reg_dec, &val_dec, false);

[Severity: High]
This isn't a bug introduced by this patch, but does this code overflow val
in the caller sbtsi_write()?

If data->ext_range_mode is enabled, a large user input val is increased without
a prior upper-bound check:

drivers/hwmon/sbtsi_temp.c:sbtsi_write() {
    ...
	if (data->ext_range_mode)
		val += SBTSI_TEMP_EXT_RANGE_ADJ;
	val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
    ...
}

Writing a large maximum value to the hwmon sysfs limit causes a signed 
integer overflow when adding the adjustment value.

The resulting negative number is passed to clamp_val, which incorrectly clamps
it to zero.

This sets the hardware temperature limit to zero degrees Celsius, which can 
instantly trigger thermal throttling or a hardware thermal shutdown.

A user or management script legitimately trying to disable or maximize the limit
by writing the maximum possible integer will unintentionally trigger a thermal 
alert instead.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710111642.850022-1-Akshay.Gupta@amd.com?part=7