[PATCH] hwmon: (nct6775) Clamp voltage limits before narrowing and scaling

[PATCH] hwmon: (nct6775) Clamp voltage limits before narrowing and scaling

[Zhu Jun]

From: zhujun <zhujun2@cmss.chinamobile.com>

store_in_reg() parses an unsigned long, but in_to_reg() takes a u32 and
multiplies it by 100 before clamping. Large limits can therefore wrap to
a low register value. For example, 4294967296 mV becomes zero on a
64-bit system.

Keep the input as an unsigned long and bound it to the register range
before scaling.

Fixes: 9de2e2e84e7d ("hwmon: Driver for Nuvoton NCT6775F, NCT6776F, and NCT6779D")
---
Validation: x86-64 and i386 driver objects built with W=1.
Source-extracted boundary tests passed on 32-bit and 64-bit;
the corresponding test fails on the base revision. I/O is mocked.
No physical sensor hardware or booted-kernel test was available.
OpenAI Codex assisted analysis, code, tests and changelog drafting.
The human submitter must review and add their Signed-off-by.

 drivers/hwmon/nct6775-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 6e97e4f08b90..b7c1e8ceaac9 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -1039,8 +1039,9 @@ static inline long in_from_reg(u8 reg, u8 nr, const u16 *scales)
 	return DIV_ROUND_CLOSEST(reg * scales[nr], 100);
 }
 
-static inline u8 in_to_reg(u32 val, u8 nr, const u16 *scales)
+static inline u8 in_to_reg(unsigned long val, u8 nr, const u16 *scales)
 {
+	val = min(val, 255UL * scales[nr] / 100);
 	return clamp_val(DIV_ROUND_CLOSEST(val * 100, scales[nr]), 0, 255);
 }
 

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.51.0

Re: [PATCH] hwmon: (nct6775) Clamp voltage limits before narrowing and scaling

[sashiko-bot]

> From: zhujun <zhujun2@cmss.chinamobile.com>
> 
> store_in_reg() parses an unsigned long, but in_to_reg() takes a u32 and
> multiplies it by 100 before clamping. Large limits can therefore wrap to
> a low register value. For example, 4294967296 mV becomes zero on a
> 64-bit system.
> 
> Keep the input as an unsigned long and bound it to the register range
> before scaling.
> 
> Fixes: 9de2e2e84e7d ("hwmon: Driver for Nuvoton NCT6775F, NCT6776F, and NCT6779D")

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109092533.5146-1-zhujun2@cmss.chinamobile.com?part=1

[PATCH] hwmon: (nct6775) Clamp voltage limits before narrowing and scaling

[Zhu Jun]

store_in_reg() parses an unsigned long, but in_to_reg() takes a u32 and
multiplies it by 100 before clamping. Large limits can therefore wrap to
a low register value. For example, 4294967296 mV becomes zero on a
64-bit system.

Keep the input as an unsigned long and bound it to the register range
before scaling.

Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/hwmon/nct6775-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 6e97e4f08b90..b7c1e8ceaac9 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -1039,8 +1039,9 @@ static inline long in_from_reg(u8 reg, u8 nr, const u16 *scales)
 	return DIV_ROUND_CLOSEST(reg * scales[nr], 100);
 }
 
-static inline u8 in_to_reg(u32 val, u8 nr, const u16 *scales)
+static inline u8 in_to_reg(unsigned long val, u8 nr, const u16 *scales)
 {
+	val = min(val, 255UL * scales[nr] / 100);
 	return clamp_val(DIV_ROUND_CLOSEST(val * 100, scales[nr]), 0, 255);
 }
 
-- 
2.51.0

[PATCH] hwmon: (nct6775) Clamp voltage limits before narrowing and scaling

[Zhu Jun]

store_in_reg() parses an unsigned long, but in_to_reg() takes a u32 and
multiplies it by 100 before clamping. Large limits can therefore wrap to
a low register value. For example, 4294967296 mV becomes zero on a
64-bit system.

Keep the input as an unsigned long and bound it to the register range
before scaling.

Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/hwmon/nct6775-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 6e97e4f08b90..b7c1e8ceaac9 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -1039,8 +1039,9 @@ static inline long in_from_reg(u8 reg, u8 nr, const u16 *scales)
 	return DIV_ROUND_CLOSEST(reg * scales[nr], 100);
 }
 
-static inline u8 in_to_reg(u32 val, u8 nr, const u16 *scales)
+static inline u8 in_to_reg(unsigned long val, u8 nr, const u16 *scales)
 {
+	val = min(val, 255UL * scales[nr] / 100);
 	return clamp_val(DIV_ROUND_CLOSEST(val * 100, scales[nr]), 0, 255);
 }
 
-- 
2.51.0

Re: [PATCH] hwmon: (nct6775) Clamp voltage limits before narrowing and scaling

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] hwmon: (nct6775) missing Fixes: trailer for in_to_reg() overflow
  fix
--

commit 4db65731cc107b583fd8b0467f24228d05ec41f5
Author: Zhu Jun <zhujun2@cmss.chinamobile.com>

> hwmon: (nct6775) Clamp voltage limits before narrowing and scaling
>
> store_in_reg() parses an unsigned long, but in_to_reg() takes a u32 and
> multiplies it by 100 before clamping. Large limits can therefore wrap to
> a low register value. For example, 4294967296 mV becomes zero on a
> 64-bit system.
>
> Keep the input as an unsigned long and bound it to the register range
> before scaling.
>
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

[Severity: Low]
Since this fixes an integer truncation and overflow in in_to_reg(), should
it include a Fixes tag:

  Fixes: 9de2e2e84e7d ("hwmon: Driver for Nuvoton NCT6775F, NCT6776F, and NCT6779D")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111023927.9234-1-zhujun2@cmss.chinamobile.com?part=1

Re: [PATCH] hwmon: (nct6775) Clamp voltage limits before narrowing and scaling

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] hwmon: (nct6775) missing Fixes trailer for in_to_reg() overflow
  fix
--

commit 942ff78cd13ea05813c6ab30f0bbe111309ffcdb
Author: Zhu Jun <zhujun2@cmss.chinamobile.com>

> hwmon: (nct6775) Clamp voltage limits before narrowing and scaling
>
> store_in_reg() parses an unsigned long, but in_to_reg() takes a u32 and
> multiplies it by 100 before clamping. Large limits can therefore wrap to
> a low register value. For example, 4294967296 mV becomes zero on a
> 64-bit system.
>
> Keep the input as an unsigned long and bound it to the register range
> before scaling.
>
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

[Severity: Low]
This fixes a bug in in_to_reg() where values parsed by store_in_reg()
can wrap when narrowed and scaled.  Should this include:

  Fixes: 9de2e2e84e7d ("hwmon: Driver for Nuvoton NCT6775F, NCT6776F, and NCT6779D")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111024524.9627-1-zhujun2@cmss.chinamobile.com?part=1

[PATCH] hwmon: (nct6775) Clamp voltage limits before narrowing and scaling

[Zhu Jun]

store_in_reg() parses an unsigned long, but in_to_reg() takes a u32 and
multiplies it by 100 before clamping. Large limits can therefore wrap to
a low register value. For example, 4294967296 mV becomes zero on a
64-bit system.

Keep the input as an unsigned long and bound it to the register range
before scaling.

Fixes: 9de2e2e84e7d ("hwmon: Driver for Nuvoton NCT6775F, NCT6776F, and NCT6779D")
Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/hwmon/nct6775-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 6e97e4f08b90..b7c1e8ceaac9 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -1039,8 +1039,9 @@ static inline long in_from_reg(u8 reg, u8 nr, const u16 *scales)
 	return DIV_ROUND_CLOSEST(reg * scales[nr], 100);
 }
 
-static inline u8 in_to_reg(u32 val, u8 nr, const u16 *scales)
+static inline u8 in_to_reg(unsigned long val, u8 nr, const u16 *scales)
 {
+	val = min(val, 255UL * scales[nr] / 100);
 	return clamp_val(DIV_ROUND_CLOSEST(val * 100, scales[nr]), 0, 255);
 }
 
-- 
2.51.0

Re: [PATCH] hwmon: (nct6775) Clamp voltage limits before narrowing and scaling

[sashiko-bot]

> store_in_reg() parses an unsigned long, but in_to_reg() takes a u32 and
> multiplies it by 100 before clamping. Large limits can therefore wrap to
> a low register value. For example, 4294967296 mV becomes zero on a
> 64-bit system.
> 
> Keep the input as an unsigned long and bound it to the register range
> before scaling.
> 
> Fixes: 9de2e2e84e7d ("hwmon: Driver for Nuvoton NCT6775F, NCT6776F, and NCT6779D")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111033623.12046-1-zhujun2@cmss.chinamobile.com?part=1