[PATCH] hwmon: (minisforum-um780xtx) Avoid overflow when rounding threshold input

[PATCH] hwmon: (minisforum-um780xtx) Avoid overflow when rounding threshold input

[Sebastián Peyrott]

The SYS fan threshold store path rounds the user-supplied millidegree value
with DIV_ROUND_CLOSEST() before clamping it. DIV_ROUND_CLOSEST() adds or
subtracts half the divisor first, so inputs within 500 of LONG_MAX or
LONG_MIN overflow and change sign. Writing LONG_MAX then selects the lower
limit instead of the upper one, and LONG_MIN the upper limit instead of the
lower one.

Clamp the input to the representable 0..255000 range before rounding. The
result is unchanged for all other inputs, because the subsequent clamp
already limits the threshold to 0..254 degrees.

Fixes: 9d980da93bbc ("hwmon: Add Minisforum UM780 XTX EC monitoring and fan control")
Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/sashiko-outbox-171941@kernel.org
Assisted-by: LLM
Signed-off-by: Sebastián Peyrott <speyrott@gmail.com>
---
This applies on top of the GCC 11 build fix:
https://lore.kernel.org/r/20261014214522.243253-1-speyrott@gmail.com

A userspace comparison using the kernel's DIV_ROUND_CLOSEST() with
-fno-strict-overflow shows identical results for every input from -300000
to 300000 across several limit pairs; only inputs near LONG_MAX/LONG_MIN
change, and they now clamp correctly. Builds without warnings with W=1
using GCC 11 (module), GCC 15 (built-in, sparse clean), and GCC 15/16
allmodconfig on x86_64 plus GCC 16 on i386.

Tested on the UM780 XTX: writing LONG_MAX to pwm2_auto_point2_temp sets
51 C with the current driver and 99 C (threshold 3 - 1) with this change;
LONG_MIN sets the lower limit. All other rounding and clamping results are
unchanged, every value was verified against the EC registers, and the
original thresholds were restored.

An LLM-based coding assistant helped analyse the report and prepare this
patch. I reviewed the change and the test results.

 drivers/hwmon/minisforum-um780xtx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/minisforum-um780xtx.c b/drivers/hwmon/minisforum-um780xtx.c
index 962ebf41ffb7..bbd77a0ce25d 100644
--- a/drivers/hwmon/minisforum-um780xtx.c
+++ b/drivers/hwmon/minisforum-um780xtx.c
@@ -205,7 +205,7 @@ static ssize_t um780xtx_sys_point_temp_store(struct device *dev,
 		lo = points[0] + 1;
 		hi = data->sys_point3 - 1;
 	}
-	value = DIV_ROUND_CLOSEST(value, 1000);
+	value = DIV_ROUND_CLOSEST(clamp_val(value, 0, 255000), 1000);
 	points[sattr->index] = clamp_val(value, lo, hi);
 
 	ret = ec_write(um780xtx_sys_point_offsets[sattr->index],

base-commit: 4781ca52761e666cf18b591e6bb0478396c90320
prerequisite-patch-id: 817e6d58067db84010e9c7f4ba73d312275021fb
-- 
2.54.0

Re: [PATCH] hwmon: (minisforum-um780xtx) Avoid overflow when rounding threshold input

[sashiko-bot]

> The SYS fan threshold store path rounds the user-supplied millidegree value
> with DIV_ROUND_CLOSEST() before clamping it. DIV_ROUND_CLOSEST() adds or
> subtracts half the divisor first, so inputs within 500 of LONG_MAX or
> LONG_MIN overflow and change sign. Writing LONG_MAX then selects the lower
> limit instead of the upper one, and LONG_MIN the upper limit instead of the
> lower one.
> 
> Clamp the input to the representable 0..255000 range before rounding. The
> result is unchanged for all other inputs, because the subsequent clamp
> already limits the threshold to 0..254 degrees.
> 
> Fixes: 9d980da93bbc ("hwmon: Add Minisforum UM780 XTX EC monitoring and fan control")
> Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/r/sashiko-outbox-171941@kernel.org
> Assisted-by: LLM
> Signed-off-by: Sebastián Peyrott <speyrott@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015033841.390615-1-speyrott@gmail.com?part=1