github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drivers/thermal/renesas/rzg3e: Fix signed integer overflow in temp_to_code()

Browse Source 
The thermal core passes -INT_MAX/INT_MAX as low/high trip points, which
the driver then converts to code values for programming the registers:

numerator = (temp_mc - info->temp_d_mc) * (priv->trmval1 - priv->trmval0);

Although 'numerator' is defined as s64, the arithmetic is performed as int.
Because of this, the multiplication overflows for -INT_MAX and, because
temp_d_mc is negative, the subtraction overflows for INT_MAX.

To fix this, cast the temperature to s64, so that the arithmetic is
performed as s64.

Fixes: dc67521c20 ("thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC")
Signed-off-by: Ovidiu Panait <ovidiu.panait.rb@renesas.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260916120003.87018-2-ovidiu.panait.rb@renesas.com
This commit is contained in:
Ovidiu Panait 2026-09-16 11:59:59 +00:00 committed by Daniel Lezcano
parent 5e3d33c3fd
commit 84f0e14e62
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/thermal/renesas/rzg3e_thermal.c
View File

@ -194,7 +194,12 @@ static u16 rzg3e_thermal_temp_to_code(struct rzg3e_thermal_priv *priv, int temp_
s64 numerator, denominator;
s64 code;
numerator = (temp_mc - info->temp_d_mc) * (priv->trmval1 - priv->trmval0);
/*
* Perform the arithmetic in 64 bits so that it cannot overflow for
* -INT_MAX/INT_MAX values passed from the thermal core or when
* userspace writes arbitrary trip point temperatures.
*/
numerator = ((s64)temp_mc - info->temp_d_mc) * (priv->trmval1 - priv->trmval0);
denominator = info->temp_e_mc - info->temp_d_mc;
code = div64_s64(numerator, denominator) + priv->trmval0;