[PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

[PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

[Zhu Jun]

temp_auto_temp_off_store() subtracts an unrestricted long from the zone
limit before clamping the resulting hysteresis. Extreme inputs can
overflow this subtraction and select the wrong end of the hysteresis
range.

Bound the requested stop temperature before calculating the difference.
A signed 8-bit zone limit and a maximum hysteresis of 15 degrees require
only the -143..127 degree range.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
---
Validation: x86-64 and i386 driver objects built with W=1.
Source-extracted boundary tests passed on both word sizes;
the corresponding test fails on the base revision. I/O is mocked.
No physical sensor or booted-kernel testing was available.
OpenAI Codex assisted analysis, code, tests and changelog drafting.
Please review and add your own Signed-off-by before submitting.

 drivers/hwmon/lm85.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 80bd1f47114d..e776ec4ae40f 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1153,6 +1153,7 @@ static ssize_t temp_auto_temp_off_store(struct device *dev,
 
 	mutex_lock(&data->update_lock);
 	min = TEMP_FROM_REG(data->zone[nr].limit);
+	val = clamp_val(val, -128000 - 15000, 127000);
 	data->zone[nr].hyst = HYST_TO_REG(min - val);
 	if (nr == 0 || nr == 1) {
 		lm85_write_value(client, LM85_REG_AFAN_HYST1,

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.51.0

Re: [PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] hwmon: (lm85) ambiguous 12-char SHA in Fixes trailer
--

commit bd3942e6e0ab99093810924c7c557da1e1780136
Author: Zhu Jun <zhujun2@cmss.chinamobile.com>

> hwmon: (lm85) Bound fan stop temperatures before subtraction
>
> temp_auto_temp_off_store() subtracts an unrestricted long from the zone
> limit before clamping the resulting hysteresis. Extreme inputs can
> overflow this subtraction and select the wrong end of the hysteresis
> range.
>
> Bound the requested stop temperature before calculating the difference.
> A signed 8-bit zone limit and a maximum hysteresis of 15 degrees require
> only the -143..127 degree range.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

[Severity: Low]
The 12-character prefix 1da177e4c3f4 in the Fixes: tag is ambiguous in the
kernel git repository and cannot be resolved cleanly.  Should this use the
13-character prefix instead:

  Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109101936.17430-1-zhujun2@cmss.chinamobile.com?part=1

Re: [PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

[Guenter Roeck]

On 11/9/26 02:19, Zhu Jun wrote:
> temp_auto_temp_off_store() subtracts an unrestricted long from the zone
> limit before clamping the resulting hysteresis. Extreme inputs can
> overflow this subtraction and select the wrong end of the hysteresis
> range.
> 
> Bound the requested stop temperature before calculating the difference.
> A signed 8-bit zone limit and a maximum hysteresis of 15 degrees require
> only the -143..127 degree range.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> ---
> Validation: x86-64 and i386 driver objects built with W=1.
> Source-extracted boundary tests passed on both word sizes;
> the corresponding test fails on the base revision. I/O is mocked.
> No physical sensor or booted-kernel testing was available.
> OpenAI Codex assisted analysis, code, tests and changelog drafting.
> Please review and add your own Signed-off-by before submitting.

You did not even read that, did you ? I can not apply any of your patches
due to the missing signature.

Guenter

> 
>   drivers/hwmon/lm85.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
> index 80bd1f47114d..e776ec4ae40f 100644
> --- a/drivers/hwmon/lm85.c
> +++ b/drivers/hwmon/lm85.c
> @@ -1153,6 +1153,7 @@ static ssize_t temp_auto_temp_off_store(struct device *dev,
>   
>   	mutex_lock(&data->update_lock);
>   	min = TEMP_FROM_REG(data->zone[nr].limit);
> +	val = clamp_val(val, -128000 - 15000, 127000);
>   	data->zone[nr].hyst = HYST_TO_REG(min - val);
>   	if (nr == 0 || nr == 1) {
>   		lm85_write_value(client, LM85_REG_AFAN_HYST1,
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb

[PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

[Zhu Jun]

temp_auto_temp_off_store() subtracts an unrestricted long from the zone
limit before clamping the resulting hysteresis. Extreme inputs can
overflow this subtraction and select the wrong end of the hysteresis
range.

Bound the requested stop temperature before calculating the difference.
A signed 8-bit zone limit and a maximum hysteresis of 15 degrees require
only the -143..127 degree range.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/hwmon/lm85.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 80bd1f47114d..e776ec4ae40f 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1153,6 +1153,7 @@ static ssize_t temp_auto_temp_off_store(struct device *dev,
 
 	mutex_lock(&data->update_lock);
 	min = TEMP_FROM_REG(data->zone[nr].limit);
+	val = clamp_val(val, -128000 - 15000, 127000);
 	data->zone[nr].hyst = HYST_TO_REG(min - val);
 	if (nr == 0 || nr == 1) {
 		lm85_write_value(client, LM85_REG_AFAN_HYST1,
-- 
2.51.0

Re: [PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

[sashiko-bot]

> temp_auto_temp_off_store() subtracts an unrestricted long from the zone
> limit before clamping the resulting hysteresis. Extreme inputs can
> overflow this subtraction and select the wrong end of the hysteresis
> range.
> 
> Bound the requested stop temperature before calculating the difference.
> A signed 8-bit zone limit and a maximum hysteresis of 15 degrees require
> only the -143..127 degree range.
> 
> Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111065324.17776-1-zhujun2@cmss.chinamobile.com?part=1

Re: [PATCH] hwmon: (lm85) Bound fan stop temperatures before subtraction

[Guenter Roeck]

On 11/10/26 22:53, Zhu Jun wrote:
> temp_auto_temp_off_store() subtracts an unrestricted long from the zone
> limit before clamping the resulting hysteresis. Extreme inputs can
> overflow this subtraction and select the wrong end of the hysteresis
> range.
> 
> Bound the requested stop temperature before calculating the difference.
> A signed 8-bit zone limit and a maximum hysteresis of 15 degrees require
> only the -143..127 degree range.
> 
> Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

I honestly can't say if you are trying to annoy me or just don't care.
This is version 2 of this patch. It should have been versioned as such,
and a change log should have been provided.

On top of that, you are flooding me with similar patches which are all
not versioned, and there is no change log. Do you seriously expect me
to dig through all your patches and path versions to figure out what
if anything (besides the added Signed-off-by: tag) changed ?

Guenter

> ---
>   drivers/hwmon/lm85.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
> index 80bd1f47114d..e776ec4ae40f 100644
> --- a/drivers/hwmon/lm85.c
> +++ b/drivers/hwmon/lm85.c
> @@ -1153,6 +1153,7 @@ static ssize_t temp_auto_temp_off_store(struct device *dev,
>   
>   	mutex_lock(&data->update_lock);
>   	min = TEMP_FROM_REG(data->zone[nr].limit);
> +	val = clamp_val(val, -128000 - 15000, 127000);
>   	data->zone[nr].hyst = HYST_TO_REG(min - val);
>   	if (nr == 0 || nr == 1) {
>   		lm85_write_value(client, LM85_REG_AFAN_HYST1,