From nobody Sat Apr 4 03:27:25 2026 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 724EC3F880D for ; Fri, 20 Mar 2026 23:56:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774050992; cv=none; b=Gr/pCHbwRMEMROKgPGR1ZY2nFoMaGbfyhkGMLlg/+wTYO3oe8NcNQj+sXowJmhD0uUQecBQBDOW90TJ979dRgJt5Jq/8eq5R8UtMTbz8soC6PjRTJwMYnzpzkLhkfmyweX4BLAxVZ4bR9X4VeJ3xz1oVKOZul9zJeg6olVyKOW4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774050992; c=relaxed/simple; bh=/ayxj6Iq3ZtFC4pNNAHwYAhIzJBpO1wGwBIQTtXpUYY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tSZwfdfAHf7Rct0pWS/CGxEW+2Sl/K696XESM6fRlMZaZ9/cfLjqulML3y5DG8FiL50/ayE10gtsaCmuSaUW2OyDcYRA7EJJG+bL8rb1iI/OVYiQL8/X0seApqct3sUvlNZbO/WWm5VQUiF68K8TGp7A2b1nS2+R1rUb4z173io= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nOSp18OB; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nOSp18OB" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-486fd5c4891so1339045e9.2 for ; Fri, 20 Mar 2026 16:56:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1774050973; x=1774655773; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=wlLxB5XuF7wDeRYUxBFcZ01DQMhckho1l6xRy+06+vo=; b=nOSp18OBTXIBSFHceC6RGD+lmeql2n+Iqj/UzOUHkkI95t1i11dBX86sF6xWbGJGaQ YvJipr+OD+Jectp/bCRWUQJqvZKrFGCxlUkFKI3sHadDK+bt0EbBzXXx6v2PdYCHVRNa J/hDCMZPEVjRBTWbTF6/1gYGl2a2S9QNGZzZfV1OX4jEe9cFw6Z92wivMYv8g+IewUZd Tlw22VK6puIuphmjyIMhNif8MbSBNZsQu7qXKpAsxnNzMMMOmBHUWBuC0NshhfDWKPYK huphq7IM9tiapmYkSsXwYajc8Kkzhztpi2Hs7ZTOk8xsqISucFcJvAGaD4tGLLJkNgmw rg1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774050973; x=1774655773; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=wlLxB5XuF7wDeRYUxBFcZ01DQMhckho1l6xRy+06+vo=; b=igBJfA2xJNo9UcKKg01pZAuOM5/TIcjL8KaTrPz5G9E1xPXlI21J63nEtwBunp5PgE L8wjDIe4PR0yMr9Skicete7nj5fhtIKS2osFfvwoQLiZ3Y4dJWl3MeBgVY9vVf2InKi+ /UB1p+iRSzR0U8CMq8qhrCRm3kQ2Dl+Swst6sMQ6hR3n9RMnXVyOZx9BeXci4dxKHmco d8Fa66RZP1pqdAzW79spcbMI1cQULhEkXUt1jeT6oz2K99lsX8ccJM8g4Wyen3FzhCTU QJAH2RBM/3VQIUYrDQAT/rhdMY2eGNDWlTJRmNWe4iDrGCiXa3E5uqDPE2Vxeld8SJjQ Pbqw== X-Forwarded-Encrypted: i=1; AJvYcCWXwAHDEykP3GuKdtkCDRsycKN/HPl3+LyQZrSh0wzeA7m0YAn4FForKl8hhvcu9SevamyNO4Vc1q27dKs=@vger.kernel.org X-Gm-Message-State: AOJu0YzzFKFDYvej9f03B3ocL5Kn1WLqr+Km1fwF3Hp6ba2ClL+QKt8Z fLwWbvb+gQqCfd8KZORT3+Xk+KgyiePYOKgdd8ztTL0HKkiiwRqk2OAj X-Gm-Gg: ATEYQzz8P7Zux/FUyse2GqScf4CmA4CqFtVhTh/MZVhBBt8BIZuMtH4qdpZU8OE5dXd +xNtkt+0vafz+hLhiNZEyVJxg+0dNrAN2+Ou7Hfkd/Bvvvbn1uQLo0EZIrS9KCI+NyKs6xXifUV 7aZMyd2i96u0F0mlpKkSRXzbO1uk5cuzApbL7YaAx0SOIaREuJA0uS0998upz+1y53Rp10iD8JD Cv2fFl1aSGEepkJ6+upH8exbiIRRLSCWp+Op7dUB4Gmd61f5/nRsUWwBfDtS/Uvz7h1brVIFwNu 1CLV/alulgeFxTl5eisrfl5VOzKigj7GuGqHva++19jlvg70GAlifp5edEjH79rHvlrZEAX3G2k KvfDZTq1evCNMBKSjKKu04b6PP8734j4YV2NKboBm2WUx1DMDmiObkoFk0ONlfQ9JaRBqy10U4W HddWz0O71Ih0O9TEfg56VSI7VaiBECXSq8DHt4kkfcTbIivJVYBQ3OQrqi X-Received: by 2002:a05:600c:1d29:b0:483:887:6e32 with SMTP id 5b1f17b1804b1-486ff02fb18mr50977025e9.8.1774050973143; Fri, 20 Mar 2026 16:56:13 -0700 (PDT) Received: from fridge ([195.174.58.89]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43b6470c239sm9663418f8f.27.2026.03.20.16.56.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 20 Mar 2026 16:56:12 -0700 (PDT) From: Emre Cecanpunar To: platform-driver-x86@vger.kernel.org Cc: hansg@kernel.org, ilpo.jarvinen@linux.intel.com, krishna.chomal108@gmail.com, linux-kernel@vger.kernel.org, Emre Cecanpunar Subject: [PATCH 4/5] platform/x86: hp-wmi: fix u8 underflow in gpu_delta calculation Date: Sat, 21 Mar 2026 02:55:56 +0300 Message-ID: <20260320235557.56298-5-emreleno@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260320235557.56298-1-emreleno@gmail.com> References: <20260320235557.56298-1-emreleno@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" gpu_delta was declared as u8 and computed as the difference of two u8 fan RPM values from the firmware fan table. If gpu_rpm < cpu_rpm, the subtraction wraps around modulo 256, producing a large positive value (e.g. 10 - 20 =3D 246 as u8). This value is then added to every requested fan speed in hp_wmi_fan_speed_set(), causing the GPU fan to be clamped to U8_MAX on almost every write. The fan table originates from an undocumented WMI interface; a firmware bug or unexpected layout could produce this condition. Change gpu_delta to int and perform the subtraction in signed arithmetic. On underflow, emit a warning and treat the delta as zero so the GPU fan tracks the CPU fan directly rather than saturating. Signed-off-by: Emre Cecanpunar --- drivers/platform/x86/hp/hp-wmi.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-= wmi.c index a29f34588055..b8f22d70e996 100644 --- a/drivers/platform/x86/hp/hp-wmi.c +++ b/drivers/platform/x86/hp/hp-wmi.c @@ -2530,8 +2530,8 @@ static int hp_wmi_setup_fan_settings(struct hp_wmi_hw= mon_priv *priv) { u8 fan_data[128] =3D { 0 }; struct victus_s_fan_table *fan_table; - u8 min_rpm, max_rpm, gpu_delta; - int ret; + u8 min_rpm, max_rpm; + int gpu_delta, ret; =20 /* Default behaviour on hwmon init is automatic mode */ priv->mode =3D PWM_MODE_AUTO; @@ -2553,10 +2553,15 @@ static int hp_wmi_setup_fan_settings(struct hp_wmi_= hwmon_priv *priv) =20 min_rpm =3D fan_table->entries[0].cpu_rpm; max_rpm =3D fan_table->entries[fan_table->header.num_entries - 1].cpu_rpm; - gpu_delta =3D fan_table->entries[0].gpu_rpm - fan_table->entries[0].cpu_r= pm; + gpu_delta =3D (int)fan_table->entries[0].gpu_rpm - + (int)fan_table->entries[0].cpu_rpm; + if (gpu_delta < 0) { + pr_warn("fan table has gpu_rpm < cpu_rpm, ignoring gpu delta\n"); + gpu_delta =3D 0; + } priv->min_rpm =3D min_rpm; priv->max_rpm =3D max_rpm; - priv->gpu_delta =3D gpu_delta; + priv->gpu_delta =3D (u8)gpu_delta; =20 return 0; } --=20 2.53.0