From nobody Sun Feb 8 09:20:37 2026 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85B312C325A for ; Tue, 2 Dec 2025 18:01:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764698494; cv=none; b=lfq2YTBEpGUo1fPGrapQu3+/a5T1Va8Kc1qOdrVEQysy8FTb5nvb549JE4jrp5bp7g1lB1JRoF71Ve8NXXQTZOmmrxus8X79O7xYIkWp8m6QNj82dzNt3tv3GAAubSZcBaryiiqM+5dKKgjK92s4Mh6J0dWhGAMMLX2aAvIk9BU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764698494; c=relaxed/simple; bh=F1BYdqfeNttcmB+PT/07KtZha4LYAw0W6s2or81VV2A=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=XBy1k6rqzShsamwyIgXLbFCMNHmmoRpoiZmn03hxsuQfny89ubZktAF6F28tcyjGLtjhVyNFCjYBsxH7Jha/9f/SAXcBW3Hl9zyM7oaOB15LdvnCvWOr8UZC5laSWffhQkdkJqDuKs4Yzzr/gQ2genKAaRVoghnAkclSHxkxbSw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=e+VJYKqr; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="e+VJYKqr" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-343ea89896eso5910755a91.2 for ; Tue, 02 Dec 2025 10:01:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764698492; x=1765303292; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=KXMEK6nb6BLzAA8eKfAM1xGhDShdGjdUjCMLODpDUpQ=; b=e+VJYKqr5Czato8snJD6WoQvhuLNk9ZYmnLkH8TJN/iVXByvW1/TlZBPIfV3YV6RdU qFkl9o/gPxNwoVd34vC1GfEc0Fm3VcVyapmie84KZaARtwNsSKOTtweQArOwcdQjy0BA 66LniapeeMoKYfBg6WPAhPEWYWW0k7A9/MVjerFpiK7Vwmn0zRWT2ZtyIGXjS7PuwGDm imm+rqBWxI5it1aw6uUo8vRallrzxncMLhYdAymnoqIFunVUXV6zpdDAl6h2TowpNO0Y q3yebNV67XaRlz8EWZ/6Q/aq2HH01pb2pN/vpOIXfne6tSIJGiMSiv7gy1UK6PyQV8Iy oJNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764698492; x=1765303292; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=KXMEK6nb6BLzAA8eKfAM1xGhDShdGjdUjCMLODpDUpQ=; b=A5ejgrT015a33cpSfQgimgdl9F1g9oxyphYBtR/0IvvgqXOKK4ytoOSuYqu4kEaIDM RMZCoCFrR3r9ZKpFe3NfncdCbZk91mKNm7wKRrf8cqfQJ64gZVvChiZIi99+DfVbx69c KNZ4Qs82C1kHNfUCcZdcBcxuSN+++t1RYB7IJLVPnQyVQQc/au6Jkm5bFz8/GE4Jvo4O kKaVhGaLjE50Cvy5oBLylCRBgUqTeeL2M/697R3PzftZtKuBuc9/9jx60HSL7PZJyVux 1CWtvGVW/+WdVxtyE4QA/VTON1tzJDHS+FYgaKEiGBqFQWdDObGCHu4/0sZm+snjkHPA 66xw== X-Forwarded-Encrypted: i=1; AJvYcCWcPpWEms++trJZ2RSOcaP7+P+ubYg9UC1GfCm4KTWOBmGqJ/naDciQD22lSiLlcTXNds9q4X8e8ZJZh/M=@vger.kernel.org X-Gm-Message-State: AOJu0Yx+sUQrwLpEUQshDeRx8EhAr9Cv/K8gTl8b1ZUO67IByF9wMAOF Dl1DoMBfcIzdJFggt32Zi+yQ1iTbEi73qPfoDU5bmxSOupQveUzOPn+W X-Gm-Gg: ASbGncuUMQ+IX6i4l5FklGOeCfivEkyw2ijkns7uJVhKadiiTIQty53PFnpWAtiSACm bq7AchcXrIYwk16tm27lnXCg63uQPl44p+dJgW5ilKDK88McRF0ivaYJNAchSCs+837+Cio31Yj NUiAEsVwSULFoHs2ust49afI2K5tdZHkBdF+Xlmot3x5O5OcGGM0SDvvQlTpBYAY2oG/mcsOdJz NtURFZfadqCPnVgX5HDiXwpgWIgHEHRayT/SDOWg07kgBQUtj86L6u+vW0EFLKBnIgI6H3XuFAJ 6hfy7WMslBwa05dpwgwXZWg1KEkRrjljL+0veQes1v5sV9gpi33/h9DeclI8ON46kYLbMk2cKap n3DDDljbAQqsNd6jMvED2Mix2O2JdDIz2CE9KE6+7eyQgqvy/KoVgSNtgVOU9nYPe0NbPLPjKM4 sW7To1+ss1fHLbvoMnvGZvnkA3BFDkNBsiBkxIKrn7IhJNgSB7LAU4FBr1wAI8fO8/e4c8eFSOH BSXURJ9WSWkF1KlWojWgdonzJ+2xfpVRXeUMIGbolmxv3ytZPdDgQYDlDId X-Google-Smtp-Source: AGHT+IEnZ9k6iLEMpgmt2GBlILolxEm6kDtzH7Uz0lXhL4SkSaNalSklDUGz9sCCEUsxCh2UqqswOw== X-Received: by 2002:a17:90b:1d49:b0:340:ff7d:c2e with SMTP id 98e67ed59e1d1-349108255femr280047a91.29.1764698491596; Tue, 02 Dec 2025 10:01:31 -0800 (PST) Received: from 2045D.localdomain (191.sub-75-229-198.myvzw.com. [75.229.198.191]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3491041244dsm126910a91.2.2025.12.02.10.01.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Dec 2025 10:01:31 -0800 (PST) From: Gui-Dong Han To: m.hulsman@tudelft.nl, linux@roeck-us.net Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, Gui-Dong Han , stable@vger.kernel.org Subject: [PATCH] hwmon: (w83791d) Convert macros to functions to avoid TOCTOU Date: Wed, 3 Dec 2025 02:01:05 +0800 Message-ID: <20251202180105.12842-1-hanguidong02@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this leads to Time-of-Check to Time-of-Use (TOCTOU) race conditions, potentially causing divide-by-zero errors. Convert the macro to a static function. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Additionally, in store_fan_div, move the calculation of the minimum limit inside the update lock. This ensures that the read-modify-write sequence operates on consistent data. Adhere to the principle of minimal changes by only converting macros that evaluate arguments multiple times and are used in lockless contexts. Link: https://lore.kernel.org/all/CALbr=3DLYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=3D= o1xxMJ8=3D5z8B-g@mail.gmail.com/ Fixes: 9873964d6eb2 ("[PATCH] HWMON: w83791d: New hardware monitoring drive= r for the Winbond W83791D")=20 Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han --- Based on the discussion in the link, I will submit a series of patches to address TOCTOU issues in the hwmon subsystem by converting macros to functions or adjusting locking where appropriate. --- drivers/hwmon/w83791d.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c index ace854b370a0..996e36951f9d 100644 --- a/drivers/hwmon/w83791d.c +++ b/drivers/hwmon/w83791d.c @@ -218,9 +218,14 @@ static u8 fan_to_reg(long rpm, int div) return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254); } =20 -#define FAN_FROM_REG(val, div) ((val) =3D=3D 0 ? -1 : \ - ((val) =3D=3D 255 ? 0 : \ - 1350000 / ((val) * (div)))) +static int fan_from_reg(int val, int div) +{ + if (val =3D=3D 0) + return -1; + if (val =3D=3D 255) + return 0; + return 1350000 / (val * div); +} =20 /* for temp1 which is 8-bit resolution, LSB =3D 1 degree Celsius */ #define TEMP1_FROM_REG(val) ((val) * 1000) @@ -521,7 +526,7 @@ static ssize_t show_##reg(struct device *dev, struct de= vice_attribute *attr, \ struct w83791d_data *data =3D w83791d_update_device(dev); \ int nr =3D sensor_attr->index; \ return sprintf(buf, "%d\n", \ - FAN_FROM_REG(data->reg[nr], DIV_FROM_REG(data->fan_div[nr]))); \ + fan_from_reg(data->reg[nr], DIV_FROM_REG(data->fan_div[nr]))); \ } =20 show_fan_reg(fan); @@ -585,10 +590,10 @@ static ssize_t store_fan_div(struct device *dev, stru= ct device_attribute *attr, if (err) return err; =20 + mutex_lock(&data->update_lock); /* Save fan_min */ - min =3D FAN_FROM_REG(data->fan_min[nr], DIV_FROM_REG(data->fan_div[nr])); + min =3D fan_from_reg(data->fan_min[nr], DIV_FROM_REG(data->fan_div[nr])); =20 - mutex_lock(&data->update_lock); data->fan_div[nr] =3D div_to_reg(nr, val); =20 switch (nr) { --=20 2.43.0