diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-12-12 08:05:33 +0100 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2014-01-03 04:33:30 +0000 |
| commit | cf3f5a3dbf78b72541dc9f295101cb90a5465d5c (patch) | |
| tree | 3c8699fb0d4476eb04e8ca8b62596823fbe573b0 | |
| parent | 362ab737e651f41282a979b9275717537b99451d (diff) | |
hwmon: Prevent some divide by zeros in FAN_TO_REG()
commit 3806b45ba4655147a011df03242cc197ab986c43 upstream.
The "rpm * div" operations can overflow here, so this patch adds an
upper limit to rpm to prevent that. Jean Delvare helped me with this
patch.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Roger Lucas <vt8231@hiddenengine.co.uk>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/hwmon/lm78.c | 2 | ||||
| -rw-r--r-- | drivers/hwmon/sis5595.c | 2 | ||||
| -rw-r--r-- | drivers/hwmon/vt8231.c | 2 |
3 files changed, 5 insertions, 1 deletions
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c index 6df0b4681710..a42a7b0cd8eb 100644 --- a/drivers/hwmon/lm78.c +++ b/drivers/hwmon/lm78.c @@ -90,6 +90,8 @@ static inline u8 FAN_TO_REG(long rpm, int div) { if (rpm <= 0) return 255; + if (rpm > 1350000) + return 1; return SENSORS_LIMIT((1350000 + rpm * div / 2) / (rpm * div), 1, 254); } diff --git a/drivers/hwmon/sis5595.c b/drivers/hwmon/sis5595.c index 47d7ce9af8fb..5ab6953d4274 100644 --- a/drivers/hwmon/sis5595.c +++ b/drivers/hwmon/sis5595.c @@ -133,6 +133,8 @@ static inline u8 FAN_TO_REG(long rpm, int div) { if (rpm <= 0) return 255; + if (rpm > 1350000) + return 1; return SENSORS_LIMIT((1350000 + rpm * div / 2) / (rpm * div), 1, 254); } diff --git a/drivers/hwmon/vt8231.c b/drivers/hwmon/vt8231.c index db3b2e8d2a67..6df67a9c8e75 100644 --- a/drivers/hwmon/vt8231.c +++ b/drivers/hwmon/vt8231.c @@ -139,7 +139,7 @@ static const u8 regtempmin[] = { 0x3a, 0x3e, 0x2c, 0x2e, 0x30, 0x32 }; */ static inline u8 FAN_TO_REG(long rpm, int div) { - if (rpm == 0) + if (rpm <= 0 || rpm > 1310720) return 0; return SENSORS_LIMIT(1310720 / (rpm * div), 1, 255); } |