[PATCH] hwmon: (it87) Bound 16-bit fan limits before conversion

[PATCH] hwmon: (it87) Bound 16-bit fan limits before conversion

[Zhu Jun]

FAN16_TO_REG() doubles an unrestricted positive long and adds 1350000
before dividing. Large fan limits can overflow these intermediate values
and select an incorrect tachometer limit. Converting LONG_MAX can select
0xfffe instead of 1.

Apply the same RPM bound used by the 8-bit conversion before doing the
arithmetic. Keep zero as the alarm-disable value.

Fixes: 17d648bf5786 ("it87: Add support for the IT8716F")
---
Validation: x86-64 and i386 driver objects built with W=1.
Source-extracted boundary tests passed on both word sizes;
the corresponding test fails on the base revision. I/O is mocked.
No physical sensor or booted-kernel testing was available.
OpenAI Codex assisted analysis, code, tests and changelog drafting.
Please review and add your own Signed-off-by before submitting.

 drivers/hwmon/it87.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index bbb3f9788c2e..b8ad1ed043b3 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -761,6 +761,7 @@ static inline u16 FAN16_TO_REG(long rpm)
 {
 	if (rpm == 0)
 		return 0xffff;
+	rpm = clamp_val(rpm, 1, 1000000);
 	return clamp_val((1350000 + rpm) / (rpm * 2), 1, 0xfffe);
 }
 

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.51.0

Re: [PATCH] hwmon: (it87) Bound 16-bit fan limits before conversion

[sashiko-bot]

> FAN16_TO_REG() doubles an unrestricted positive long and adds 1350000
> before dividing. Large fan limits can overflow these intermediate values
> and select an incorrect tachometer limit. Converting LONG_MAX can select
> 0xfffe instead of 1.
> 
> Apply the same RPM bound used by the 8-bit conversion before doing the
> arithmetic. Keep zero as the alarm-disable value.
> 
> Fixes: 17d648bf5786 ("it87: Add support for the IT8716F")

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109101726.16875-1-zhujun2@cmss.chinamobile.com?part=1

[PATCH] hwmon: (it87) Bound 16-bit fan limits before conversion

[Zhu Jun]

FAN16_TO_REG() doubles an unrestricted positive long and adds 1350000
before dividing. Large fan limits can overflow these intermediate values
and select an incorrect tachometer limit. Converting LONG_MAX can select
0xfffe instead of 1.

Apply the same RPM bound used by the 8-bit conversion before doing the
arithmetic. Keep zero as the alarm-disable value.

Fixes: 17d648bf5786 ("it87: Add support for the IT8716F")
Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/hwmon/it87.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index bbb3f9788c2e..b8ad1ed043b3 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -761,6 +761,7 @@ static inline u16 FAN16_TO_REG(long rpm)
 {
 	if (rpm == 0)
 		return 0xffff;
+	rpm = clamp_val(rpm, 1, 1000000);
 	return clamp_val((1350000 + rpm) / (rpm * 2), 1, 0xfffe);
 }
 
-- 
2.51.0

Re: [PATCH] hwmon: (it87) Bound 16-bit fan limits before conversion

[sashiko-bot]

> FAN16_TO_REG() doubles an unrestricted positive long and adds 1350000
> before dividing. Large fan limits can overflow these intermediate values
> and select an incorrect tachometer limit. Converting LONG_MAX can select
> 0xfffe instead of 1.
> 
> Apply the same RPM bound used by the 8-bit conversion before doing the
> arithmetic. Keep zero as the alarm-disable value.
> 
> Fixes: 17d648bf5786 ("it87: Add support for the IT8716F")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111065246.17682-1-zhujun2@cmss.chinamobile.com?part=1