Commit c98fe8bc authored by Guenter Roeck's avatar Guenter Roeck Committed by Chen Zhongjin
Browse files

hwmon: (adc128d818) Fix underflows seen when writing limit attributes 

stable inclusion
from stable-v6.6.51
commit 6891b11a0c6227ca7ed15786928a07b1c0e4d4af
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWHX
CVE: CVE-2024-46759

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6891b11a0c6227ca7ed15786928a07b1c0e4d4af



--------------------------------

[ Upstream commit 8cad724c8537fe3e0da8004646abc00290adae40 ]

DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large
negative number such as -9223372036854775808 is provided by the user.
Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.

Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Zhongjin <chenzhongjin@huawei.com>
parent a161fff2

drivers/hwmon/adc128d818.c

+2 −2
Original line number Diff line number Diff line
@@ -176,7 +176,7 @@ static ssize_t adc128_in_store(struct device *dev, 


	mutex_lock(&data->update_lock);

	/* 10 mV LSB on limit registers */

	regval = clamp_val(DIV_ROUND_CLOSEST(val, 10), 0, 255);

	regval = DIV_ROUND_CLOSEST(clamp_val(val, 0, 2550), 10);

	data->in[index][nr] = regval << 4;

	reg = index == 1 ? ADC128_REG_IN_MIN(nr) : ADC128_REG_IN_MAX(nr);

	i2c_smbus_write_byte_data(data->client, reg, regval);
@@ -214,7 +214,7 @@ static ssize_t adc128_temp_store(struct device *dev, 
		return err;



	mutex_lock(&data->update_lock);

	regval = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127);

	regval = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000);

	data->temp[index] = regval << 1;

	i2c_smbus_write_byte_data(data->client,

				  index == 1 ? ADC128_REG_TEMP_MAX