From 84f0e14e6261ef718e6a8583073097ad9ea70e14 Mon Sep 17 00:00:00 2001 From: Ovidiu Panait Date: Wed, 16 Sep 2026 11:59:59 +0000 Subject: [PATCH] drivers/thermal/renesas/rzg3e: Fix signed integer overflow in temp_to_code() The thermal core passes -INT_MAX/INT_MAX as low/high trip points, which the driver then converts to code values for programming the registers: numerator = (temp_mc - info->temp_d_mc) * (priv->trmval1 - priv->trmval0); Although 'numerator' is defined as s64, the arithmetic is performed as int. Because of this, the multiplication overflows for -INT_MAX and, because temp_d_mc is negative, the subtraction overflows for INT_MAX. To fix this, cast the temperature to s64, so that the arithmetic is performed as s64. Fixes: dc67521c20b7 ("thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC") Signed-off-by: Ovidiu Panait Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20260916120003.87018-2-ovidiu.panait.rb@renesas.com --- drivers/thermal/renesas/rzg3e_thermal.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/thermal/renesas/rzg3e_thermal.c b/drivers/thermal/renesas/rzg3e_thermal.c index c44f5b8858d0..4acee4eaff05 100644 --- a/drivers/thermal/renesas/rzg3e_thermal.c +++ b/drivers/thermal/renesas/rzg3e_thermal.c @@ -194,7 +194,12 @@ static u16 rzg3e_thermal_temp_to_code(struct rzg3e_thermal_priv *priv, int temp_ s64 numerator, denominator; s64 code; - numerator = (temp_mc - info->temp_d_mc) * (priv->trmval1 - priv->trmval0); + /* + * Perform the arithmetic in 64 bits so that it cannot overflow for + * -INT_MAX/INT_MAX values passed from the thermal core or when + * userspace writes arbitrary trip point temperatures. + */ + numerator = ((s64)temp_mc - info->temp_d_mc) * (priv->trmval1 - priv->trmval0); denominator = info->temp_e_mc - info->temp_d_mc; code = div64_s64(numerator, denominator) + priv->trmval0;