Re: [PATCH] hwmon: (sht3x) Fix overflow when writing alert limits

[sashiko-bot@kernel.org]

> limit_write() encodes the limits with 32-bit arithmetic, which overflows
> for the largest accepted values:
> 
>   (130000 + 45000) * 24543 = 4295025000 > U32_MAX
>   100000 * 42950           = 4295000000 > U32_MAX
> 
> Writing 130000 to temp1_max therefore programs -45 degrees C, and
> writing 100000 to humidity1_max programs 0 %RH, so a limit set to its
> maximum makes the alert fire instead of never firing. Reading the
> attributes back returns the cached values, so this is not visible from
> sysfs.
> 
> Use 64-bit arithmetic and clamp each result to its field width. Even
> with 64-bit arithmetic, 130000 encodes to 0x200, which overflows the
> 9-bit temperature field, and 100000 encodes to 0x10000, which is still 0
> after masking.
> 
> Prepared with the help of an AI coding assistant (Claude); I reproduced
> the bug and tested the fix on hardware.
> 
> Fixes: 7c84f7f80d6f ("hwmon: add support for Sensirion SHT3x sensors")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/linux-hwmon/20260725222229.EA69B1F000E9@smtp.kernel.org/
> Signed-off-by: Wayne Ho <wayneho219@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113054857.97048-1-wayneho219@gmail.com?part=1