From nobody Sun Feb 8 01:56:21 2026 Received: from mail-lf1-f51.google.com (mail-lf1-f51.google.com [209.85.167.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D994B3168F5 for ; Thu, 11 Dec 2025 16:44:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765471444; cv=none; b=D5USaWM1LjK4LAjlOcWHJfK9iEPzG5ZmIp3SOpLcDBdIKndwP33X+Nz6dyjeVPaDTJd1Tuxkaq8qQPFQyKjHK04sbzzViF0g7foGDrNTzr2tB6f0uUOvtXT64XfFfIOD3VYSCR5EJUrnCf3emx+YIPEQCl+hx9M3sRmvosgli4M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765471444; c=relaxed/simple; bh=wFC3uacQOtLA91H18q8YDGxjUWrFwbqfyIofOp3fvHs=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=NsYwtdfasbXesQNabblOSWa8fagV8bSanT9K80Fw2D3GDjcM4PsA0VoypPAPKbCltwnWUS3sVvLIgSyz/7DALBhnEROu2F8+0t9xzTiUJ3RB+Hqrc3GBlb7OnhTdv3Usn+Igek6erP+1i7JMHmmlfbUilVNtM83VIvjtDJoHH+E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=K4sPjVDV; arc=none smtp.client-ip=209.85.167.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="K4sPjVDV" Received: by mail-lf1-f51.google.com with SMTP id 2adb3069b0e04-59577c4c7c1so264400e87.1 for ; Thu, 11 Dec 2025 08:44:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765471440; x=1766076240; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=OavUonQftMPU4AusrYb98irWIVF8Pjqq16PFFGKIUtg=; b=K4sPjVDVflBKqfbsDXOZvNWEwwTi8iG9LYe4nRgWW0+n5gOgdm+1yBjUL1mHm7ft+T I6fIvBH3zcn7cmaYfV99h8haVmqP25lRQVgKZxQSu6rzrQDxQV41/5MRZMOtL5f3hpfN /K2ZjVmX0SfkuLzZtHoLQxfCrQk9HXXbr521pF+7jFowOqIzC+KwjDN5zWd2v+gnoTS6 W9cBL1/IplELR+oPVMMmTXaxkqJfi2y9WU5iv7EK3eZ+/4sJyeNXLWCoD+g7VX1r0bSh xgNP49ORmAULLC/KQeJR45ZbTDXMmA8J+rvv+aZRtQhP+6SogTl89CzyxUA0/FM2MyV5 BHxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765471440; x=1766076240; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=OavUonQftMPU4AusrYb98irWIVF8Pjqq16PFFGKIUtg=; b=NfIZ3iR/fSZcblXXtdS5UFJbOvptO9v1+1ONvgaPZsRjYcJM2wTtvQZRsEX3/vN95x 913kKODpYEamQREwixpP3OTX+ZNkzob9acYQfrNrL0SIBCDgLQbTkpYzgDGpiSsJddTq 3xfvS9YOEnsOG8QM1KBnKJxSuSQTxwlJTeIH9FgAYLNdCoVJor6oJX38FgM8jTX9CpQK 43xqXKpYK7SM/6eMImg/LBcSwGUtz4gezoad8ahyULB5tLxXOqbWsXkqjdZE75IYeuI2 Eq71H8D6/K6lJ/KzL9WQ+ByfDHI8i6DzdGc7VnBVKz5H5XUix/Y1iUS6zuK4JX9W3jIw ksDA== X-Forwarded-Encrypted: i=1; AJvYcCVUvHHPz3DVEM1gpQQQe6ZBQe/dr+YXSzji7vI9MCs3D/6OwQmrDE22o7AtQubKXv9xU20/nZDeqJh3Fb4=@vger.kernel.org X-Gm-Message-State: AOJu0Yye6wQnwWMFMt664DYgqQbEexHHjVPOLyQPHgg5SlkzgbwBZ3pT IWoduB2cqPtEZck5WCjNUYR+9/p79kq8JXSx9CXTLtzRPHXTXMGymObG X-Gm-Gg: AY/fxX6t7wSqspn9ShmA3tiH057eS2eLDiWVGrEatSwMgAzmcXJbTclc1c2S7azqL/b m7M/y+l+RfNYCJHbjlAOYGZevATlT8cs5WWm8UWNrqITmXKAYooHLxWbgY/FgLnpSUDuB/3jImQ A8g9+fGrQkQxe1NtP9JJNDNN5x7TYjhASeROZQ1Se3yXO5m2BFBcWOzUKSU6VCGRrSnEDP1P/me 6mB39nftnl/su1ECfLvmvW1jhrfEw2WvlZig73uf0PUfjUB1Qws1Xrc3TrAvrMxc6gqxUSljmIq l5TkGX5bBwmxrA3FpgHyaX2h4TOBOlYEwOoUeyOHM8AGOOQuR6XdtXqwpdvxt9IVmL+zkCG0rKC qCN6hSFBYGAcBmTg9iJn7LYn1IdMBuiqCHX+FFzD6RL19KsgUju0fu2NCSdh1mOLGs9XpxJjE0E ZM1XVpFQ7IjbG+ojS2IzT/q3TelrVTCyi/EC/vLjg7nbQCHb1H X-Google-Smtp-Source: AGHT+IHTEtRxy1U1n075qhAv+e9rs1LRt3U/+P5ZaZEE4Enm/Bu3yoBNRSvtsoFvldNP4eV/vPi8sQ== X-Received: by 2002:a05:6512:39c4:b0:595:7d7c:59a9 with SMTP id 2adb3069b0e04-598f42a6f23mr865413e87.22.1765471439546; Thu, 11 Dec 2025 08:43:59 -0800 (PST) Received: from home-server.lan (89-109-48-215.dynamic.mts-nn.ru. [89.109.48.215]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-598f2f44d36sm1023437e87.36.2025.12.11.08.43.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 Dec 2025 08:43:59 -0800 (PST) From: Alexey Simakov To: Guenter Roeck Cc: Alexey Simakov , linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Subject: [PATCH] hwmon (tmp401): fix overflow caused by default conversion rate value Date: Thu, 11 Dec 2025 19:43:43 +0300 Message-Id: <20251211164342.6291-1-bigalex934@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The driver computes conversion intervals using the formula: interval =3D (1 << (7 - rate)) * 125ms where 'rate' is the sensor's conversion rate register value. According to the datasheet, the power-on reset value of this register is 0x8, which could be assigned to the register, after handling i2c general call. Using this default value causes a result greater than the bit width of left operand and an undefined behaviour in the calculation above, since shifting by values larger than the bit width is undefined behaviour as per C language standard. Limit the maximum usable 'rate' value to 7 to prevent undefined behaviour in calculations. Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: ca53e7640de7 ("hwmon: (tmp401) Convert to _info API") Signed-off-by: Alexey Simakov --- drivers/hwmon/tmp401.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/tmp401.c b/drivers/hwmon/tmp401.c index 02c5a3bb1071..84aaf817144c 100644 --- a/drivers/hwmon/tmp401.c +++ b/drivers/hwmon/tmp401.c @@ -401,7 +401,7 @@ static int tmp401_chip_read(struct device *dev, u32 att= r, int channel, long *val ret =3D regmap_read(data->regmap, TMP401_CONVERSION_RATE, ®val); if (ret < 0) return ret; - *val =3D (1 << (7 - regval)) * 125; + *val =3D (1 << (7 - min(regval, 7))) * 125; break; case hwmon_chip_temp_reset_history: *val =3D 0; --=20 2.34.1