When the flag relax_fan_constraint is set, local variable 'raw'
is never assigned, and lwmi_om_hwmon_write() will pass uninitialized
value to lwmi_om_fan_get_set() resulting in undefined behavior.

This flag allows user to bypass minimum fan RPM divisor rounding,
but assignment to 'raw' only happens in the non-relaxed path.
Fix by defaulting 'raw' to user provided 'val' in the else branch.

Fixes: 51ed34282f63 ("platform/x86: lenovo-wmi-other: Add HWMON for fan reporting/tuning")
Reviewed-by: Rong Zhang <i@rong.moe>
Signed-off-by: Yufei CHENG <cd345al@gmail.com>
---
v3: fix broken format
v2: rewrite the title to be more specific

 drivers/platform/x86/lenovo/wmi-other.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/platform/x86/lenovo/wmi-other.c b/drivers/platform/x86/lenovo/wmi-other.c
index 6040f45aa2b..6c2febe1a59 100644
--- a/drivers/platform/x86/lenovo/wmi-other.c
+++ b/drivers/platform/x86/lenovo/wmi-other.c
@@ -349,6 +349,8 @@ static int lwmi_om_hwmon_write(struct device *dev, enum hwmon_sensor_types type,
 			 */
 			if (!relax_fan_constraint)
 				raw = val / LWMI_FAN_DIV * LWMI_FAN_DIV;
+			else
+				raw = val;
 
 			err = lwmi_om_fan_get_set(priv, channel, &raw, true);
 			if (err)
-- 
2.43.0

On Mon, 27 Apr 2026 00:50:34 +0800, Yufei CHENG wrote:

> When the flag relax_fan_constraint is set, local variable 'raw'
> is never assigned, and lwmi_om_hwmon_write() will pass uninitialized
> value to lwmi_om_fan_get_set() resulting in undefined behavior.
> 
> This flag allows user to bypass minimum fan RPM divisor rounding,
> but assignment to 'raw' only happens in the non-relaxed path.
> Fix by defaulting 'raw' to user provided 'val' in the else branch.
> 
> [...]


Thank you for your contribution, it has been applied to my local
review-ilpo-fixes branch. Note it will show up in the public
platform-drivers-x86/review-ilpo-fixes branch only once I've pushed my
local branch there, which might take a while.

The list of commits applied:
[1/1] platform/x86: lenovo: wmi-other: Fix uninitialized variable in lwmi_om_hwmon_write()
      commit: 863810d4985ad214f70c1623f24384ccc850f2a2

--
 i.