Patch "hwmon: (g762) Fix overflows and crash seen when writing limit attributes" has been added to the 4.4-stable tree

Patch "hwmon: (g762) Fix overflows and crash seen when writing limit attributes" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    hwmon: (g762) Fix overflows and crash seen when writing limit attributes

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hwmon-g762-fix-overflows-and-crash-seen-when-writing-limit-attributes.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 4fccd4a1e8944033bcd7693ea4e8fb478cd2059a Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Sun, 11 Dec 2016 13:27:42 -0800
Subject: hwmon: (g762) Fix overflows and crash seen when writing limit attributes

From: Guenter Roeck <linux@roeck-us.net>

commit 4fccd4a1e8944033bcd7693ea4e8fb478cd2059a upstream.

Fix overflows seen when writing into fan speed limit attributes.
Also fix crash due to division by zero, seen when certain very
large values (such as 2147483648, or 0x80000000) are written
into fan speed limit attributes.

Fixes: 594fbe713bf60 ("Add support for GMT G762/G763 PWM fan controllers")
Cc: Arnaud Ebalard <arno@natisbad.org>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/g762.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/hwmon/g762.c
+++ b/drivers/hwmon/g762.c
@@ -193,14 +193,17 @@ static inline unsigned int rpm_from_cnt(
  * Convert fan RPM value from sysfs into count value for fan controller
  * register (FAN_SET_CNT).
  */
-static inline unsigned char cnt_from_rpm(u32 rpm, u32 clk_freq, u16 p,
+static inline unsigned char cnt_from_rpm(unsigned long rpm, u32 clk_freq, u16 p,
 					 u8 clk_div, u8 gear_mult)
 {
-	if (!rpm)         /* to stop the fan, set cnt to 255 */
+	unsigned long f1 = clk_freq * 30 * gear_mult;
+	unsigned long f2 = p * clk_div;
+
+	if (!rpm)	/* to stop the fan, set cnt to 255 */
 		return 0xff;
 
-	return clamp_val(((clk_freq * 30 * gear_mult) / (rpm * p * clk_div)),
-			 0, 255);
+	rpm = clamp_val(rpm, f1 / (255 * f2), ULONG_MAX / f2);
+	return DIV_ROUND_CLOSEST(f1, rpm * f2);
 }
 
 /* helper to grab and cache data, at most one time per second */


Patches currently in stable-queue which might be from linux@roeck-us.net are

queue-4.4/hwmon-ds620-fix-overflows-seen-when-writing-temperature-limits.patch
queue-4.4/hwmon-amc6821-sign-extension-temperature.patch
queue-4.4/hwmon-scpi-fix-module-autoload.patch
queue-4.4/hwmon-nct7802-fix-overflows-seen-when-writing-into-limit-attributes.patch
queue-4.4/cris-only-build-flash-rescue-image-if-config_etrax_axisflashmap-is-selected.patch
queue-4.4/hwmon-g762-fix-overflows-and-crash-seen-when-writing-limit-attributes.patch