breeze/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-01-12 00:42:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

hwmon: (dell-smm) Limit fan multiplier to avoid overflow

Browse Source 
The fan nominal speed returned by SMM is limited to 16 bits, but the
driver allows the fan multiplier to be set via a module parameter.

Clamp the computed fan multiplier so that fan_nominal_speed *
i8k_fan_mult always fits into a signed 32-bit integer and refuse to
initialize the driver if the value is too large.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 20bdeebc88 ("hwmon: (dell-smm) Introduce helper function for data init")
Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
Link: https://lore.kernel.org/r/20251209063706.49008-1-denserg.edu@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
This commit is contained in:
Denis Sergeev
2025-12-09 09:37:06 +03:00
committed by Guenter Roeck
parent 8f0b4cce44
commit 46c28bbbb1
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/hwmon/dell-smm-hwmon.c
View File

@@ -76,6 +76,9 @@
#define DELL_SMM_NO_TEMP 10
#define DELL_SMM_NO_FANS 4
/* limit fan multiplier to avoid overflow */
#define DELL_SMM_MAX_FAN_MULT (INT_MAX / U16_MAX)
struct smm_regs {
unsigned int eax;
unsigned int ebx;
@@ -1253,6 +1256,12 @@ static int dell_smm_init_data(struct device *dev, const struct dell_smm_ops *ops
data->ops = ops;
/* All options must not be 0 */
data->i8k_fan_mult = fan_mult ? : I8K_FAN_MULT;
if (data->i8k_fan_mult > DELL_SMM_MAX_FAN_MULT) {
dev_err(dev,
"fan multiplier %u is too large (max %u)\n",
data->i8k_fan_mult, DELL_SMM_MAX_FAN_MULT);
return -EINVAL;
}
data->i8k_fan_max = fan_max ? : I8K_FAN_HIGH;
data->i8k_pwm_mult = DIV_ROUND_UP(255, data->i8k_fan_max);