[PATCH] hwmon: (w83627ehf) Clamp fan control times before rounding

[PATCH] hwmon: (w83627ehf) Clamp fan control times before rounding

[Zhu Jun]

The fan time stores pass an unsigned long to step_time_to_reg(), which
takes unsigned int. Large values can be truncated or overflow when the
rounding adjustment is added. For example, 4294967295 ms selects
register 1 instead of 255.

Keep the input as unsigned long and bound it to the maximum duration
before applying the PWM or DC mode conversion.

Fixes: 08c79950a047 ("hwmon: Add fan speed control features to w83627ehf")
---
Validation: x86-64 and i386 driver objects built with W=1.
Source-extracted boundary tests passed on both word sizes;
the corresponding test fails on the base revision. I/O is mocked.
No physical sensor or booted-kernel testing was available.
OpenAI Codex assisted analysis, code, tests and changelog drafting.
Please review and add your own Signed-off-by before submitting.

 drivers/hwmon/w83627ehf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index 9c08ab662dc6..5bcb0a5fd095 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -258,8 +258,9 @@ static inline unsigned int step_time_from_reg(u8 reg, u8 mode)
 	return mode ? 100 * reg : 400 * reg;
 }
 
-static inline u8 step_time_to_reg(unsigned int msec, u8 mode)
+static inline u8 step_time_to_reg(unsigned long msec, u8 mode)
 {
+	msec = min(msec, 255UL * (mode ? 100 : 400));
 	return clamp_val((mode ? (msec + 50) / 100 : (msec + 200) / 400),
 			 1, 255);
 }

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.51.0

Re: [PATCH] hwmon: (w83627ehf) Clamp fan control times before rounding

[sashiko-bot]

> The fan time stores pass an unsigned long to step_time_to_reg(), which
> takes unsigned int. Large values can be truncated or overflow when the
> rounding adjustment is added. For example, 4294967295 ms selects
> register 1 instead of 255.
> 
> Keep the input as unsigned long and bound it to the maximum duration
> before applying the PWM or DC mode conversion.
> 
> Fixes: 08c79950a047 ("hwmon: Add fan speed control features to w83627ehf")

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109101657.16793-1-zhujun2@cmss.chinamobile.com?part=1

[PATCH] hwmon: (w83627ehf) Clamp fan control times before rounding

[Zhu Jun]

The fan time stores pass an unsigned long to step_time_to_reg(), which
takes unsigned int. Large values can be truncated or overflow when the
rounding adjustment is added. For example, 4294967295 ms selects
register 1 instead of 255.

Keep the input as unsigned long and bound it to the maximum duration
before applying the PWM or DC mode conversion.

Fixes: 08c79950a047 ("hwmon: Add fan speed control features to w83627ehf")
Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/hwmon/w83627ehf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index 9c08ab662dc6..5bcb0a5fd095 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -258,8 +258,9 @@ static inline unsigned int step_time_from_reg(u8 reg, u8 mode)
 	return mode ? 100 * reg : 400 * reg;
 }
 
-static inline u8 step_time_to_reg(unsigned int msec, u8 mode)
+static inline u8 step_time_to_reg(unsigned long msec, u8 mode)
 {
+	msec = min(msec, 255UL * (mode ? 100 : 400));
 	return clamp_val((mode ? (msec + 50) / 100 : (msec + 200) / 400),
 			 1, 255);
 }
-- 
2.51.0

Re: [PATCH] hwmon: (w83627ehf) Clamp fan control times before rounding

[sashiko-bot]

> The fan time stores pass an unsigned long to step_time_to_reg(), which
> takes unsigned int. Large values can be truncated or overflow when the
> rounding adjustment is added. For example, 4294967295 ms selects
> register 1 instead of 255.
> 
> Keep the input as unsigned long and bound it to the maximum duration
> before applying the PWM or DC mode conversion.
> 
> Fixes: 08c79950a047 ("hwmon: Add fan speed control features to w83627ehf")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111065238.17669-1-zhujun2@cmss.chinamobile.com?part=1