[PATCH] hwmon: (nct6775) Clamp fan control times before rounding

[PATCH] hwmon: (nct6775) Clamp fan control times before rounding

[Zhu Jun]

store_fan_time() accepts an unsigned long, but step_time_to_reg()
narrows it to unsigned int and adds the rounding adjustment before
clamping. For example, 4294967295 ms wraps and selects register 1
instead of 255 in either mode.

Preserve the input width and clamp to the maximum duration for the
selected mode before rounding.

Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")
---
Validation: x86-64 and i386 driver objects built with W=1.
Source-extracted boundary tests passed on both word sizes;
the corresponding test fails on the base revision. I/O is mocked.
No physical sensor or booted-kernel testing was available.
OpenAI Codex assisted analysis, code, tests and changelog drafting.
Please review and add your own Signed-off-by before submitting.

 drivers/hwmon/nct6775-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 6e97e4f08b90..76b2c9551a1c 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -949,8 +949,9 @@ static unsigned int step_time_from_reg(u8 reg, u8 mode)
 	return mode ? 400 * reg : 100 * reg;
 }
 
-static u8 step_time_to_reg(unsigned int msec, u8 mode)
+static u8 step_time_to_reg(unsigned long msec, u8 mode)
 {
+	msec = min(msec, 255UL * (mode ? 400 : 100));
 	return clamp_val((mode ? (msec + 200) / 400 :
 					(msec + 50) / 100), 1, 255);
 }

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.51.0

Re: [PATCH] hwmon: (nct6775) Clamp fan control times before rounding

[sashiko-bot]

> store_fan_time() accepts an unsigned long, but step_time_to_reg()
> narrows it to unsigned int and adds the rounding adjustment before
> clamping. For example, 4294967295 ms wraps and selects register 1
> instead of 255 in either mode.
> 
> Preserve the input width and clamp to the maximum duration for the
> selected mode before rounding.
> 
> Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109101629.16713-1-zhujun2@cmss.chinamobile.com?part=1

[PATCH] hwmon: (nct6775) Clamp fan control times before rounding

[Zhu Jun]

store_fan_time() accepts an unsigned long, but step_time_to_reg()
narrows it to unsigned int and adds the rounding adjustment before
clamping. For example, 4294967295 ms wraps and selects register 1
instead of 255 in either mode.

Preserve the input width and clamp to the maximum duration for the
selected mode before rounding.

Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/hwmon/nct6775-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 6e97e4f08b90..76b2c9551a1c 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -949,8 +949,9 @@ static unsigned int step_time_from_reg(u8 reg, u8 mode)
 	return mode ? 400 * reg : 100 * reg;
 }
 
-static u8 step_time_to_reg(unsigned int msec, u8 mode)
+static u8 step_time_to_reg(unsigned long msec, u8 mode)
 {
+	msec = min(msec, 255UL * (mode ? 400 : 100));
 	return clamp_val((mode ? (msec + 200) / 400 :
 					(msec + 50) / 100), 1, 255);
 }
-- 
2.51.0

Re: [PATCH] hwmon: (nct6775) Clamp fan control times before rounding

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] hwmon: (nct6775) missing Fixes: trailer for step_time_to_reg()
  bug fix
--

commit befc95af1cfff1fb8b3fc9efb4b1e43ee7673fb9
Author: Zhu Jun <zhujun2@cmss.chinamobile.com>

> hwmon: (nct6775) Clamp fan control times before rounding
>
> store_fan_time() accepts an unsigned long, but step_time_to_reg()
> narrows it to unsigned int and adds the rounding adjustment before
> clamping. For example, 4294967295 ms wraps and selects register 1
> instead of 255 in either mode.
>
> Preserve the input width and clamp to the maximum duration for the
> selected mode before rounding.
>
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

[Severity: Low]
This fixes a narrowing and rounding overflow bug in step_time_to_reg().
Should this include a Fixes tag for the commit that introduced
step_time_to_reg() and store_fan_time()?

  Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111024607.9712-1-zhujun2@cmss.chinamobile.com?part=1

[PATCH] hwmon: (nct6775) Clamp fan control times before rounding

[Zhu Jun]

store_fan_time() accepts an unsigned long, but step_time_to_reg()
narrows it to unsigned int and adds the rounding adjustment before
clamping. For example, 4294967295 ms wraps and selects register 1
instead of 255 in either mode.

Preserve the input width and clamp to the maximum duration for the
selected mode before rounding.

Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")
Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/hwmon/nct6775-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 6e97e4f08b90..76b2c9551a1c 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -949,8 +949,9 @@ static unsigned int step_time_from_reg(u8 reg, u8 mode)
 	return mode ? 400 * reg : 100 * reg;
 }
 
-static u8 step_time_to_reg(unsigned int msec, u8 mode)
+static u8 step_time_to_reg(unsigned long msec, u8 mode)
 {
+	msec = min(msec, 255UL * (mode ? 400 : 100));
 	return clamp_val((mode ? (msec + 200) / 400 :
 					(msec + 50) / 100), 1, 255);
 }
-- 
2.51.0

Re: [PATCH] hwmon: (nct6775) Clamp fan control times before rounding

[sashiko-bot]

> store_fan_time() accepts an unsigned long, but step_time_to_reg()
> narrows it to unsigned int and adds the rounding adjustment before
> clamping. For example, 4294967295 ms wraps and selects register 1
> instead of 255 in either mode.
> 
> Preserve the input width and clamp to the maximum duration for the
> selected mode before rounding.
> 
> Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111033954.12468-1-zhujun2@cmss.chinamobile.com?part=1

Re: [PATCH] hwmon: (nct6775) Clamp fan control times before rounding

[David Laight]

On Wed, 11 Nov 2026 11:39:54 +0800
Zhu Jun <zhujun2@cmss.chinamobile.com> wrote:

> store_fan_time() accepts an unsigned long, but step_time_to_reg()
> narrows it to unsigned int and adds the rounding adjustment before
> clamping. For example, 4294967295 ms wraps and selects register 1
> instead of 255 in either mode.
> 
> Preserve the input width and clamp to the maximum duration for the
> selected mode before rounding.
> 
> Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
> ---
>  drivers/hwmon/nct6775-core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
> index 6e97e4f08b90..76b2c9551a1c 100644
> --- a/drivers/hwmon/nct6775-core.c
> +++ b/drivers/hwmon/nct6775-core.c
> @@ -949,8 +949,9 @@ static unsigned int step_time_from_reg(u8 reg, u8 mode)
>  	return mode ? 400 * reg : 100 * reg;
>  }
>  
> -static u8 step_time_to_reg(unsigned int msec, u8 mode)
> +static u8 step_time_to_reg(unsigned long msec, u8 mode)
>  {
> +	msec = min(msec, 255UL * (mode ? 400 : 100));
>  	return clamp_val((mode ? (msec + 200) / 400 :
>  					(msec + 50) / 100), 1, 255);

Just do most of the division before doing the add:
	return clamp((msec / (mode ? 200 : 50) + 1) / 2, 1, 255);

(It should never have been clamp_val(), the correct change was 1u, 255u.
Not needed any more.)

David

>  }