[PATCH] hwmon: (w83l786ng) Clamp voltage limits before rounding

[PATCH] hwmon: (w83l786ng) Clamp voltage limits before rounding

[Zhu Jun]

IN_TO_REG() adds 4 to an unrestricted unsigned long. Inputs close to
ULONG_MAX wrap, so an excessive voltage limit can select register zero
instead of 255.

Clamp to the 0..2040 mV register range before rounding to 8 mV units.

Fixes: 85f03bccd6e0 ("hwmon: Add support for Winbond W83L786NG/NR")
---
Validation: x86-64 and i386 driver objects built with W=1.
Source-extracted boundary tests passed on both word sizes;
the corresponding test fails on the base revision. I/O is mocked.
No physical sensor or booted-kernel testing was available.
OpenAI Codex assisted analysis, code, tests and changelog drafting.
Please review and add your own Signed-off-by before submitting.

 drivers/hwmon/w83l786ng.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
index d16afda34e41..0cd545011e73 100644
--- a/drivers/hwmon/w83l786ng.c
+++ b/drivers/hwmon/w83l786ng.c
@@ -101,7 +101,7 @@ static int temp_from_reg(int val)
  * in mV as would be measured on the chip input pin, need to just
  * multiply/divide by 8 to translate from/to register values.
  */
-#define IN_TO_REG(val)		(clamp_val((((val) + 4) / 8), 0, 255))
+#define IN_TO_REG(val)		((clamp_val((val), 0, 2040) + 4) / 8)
 #define IN_FROM_REG(val)	((val) * 8)
 
 #define DIV_FROM_REG(val)	(1 << (val))

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.51.0

Re: [PATCH] hwmon: (w83l786ng) Clamp voltage limits before rounding

[David Laight]

On Mon,  9 Nov 2026 18:19:16 +0800
Zhu Jun <zhujun2@cmss.chinamobile.com> wrote:

> IN_TO_REG() adds 4 to an unrestricted unsigned long. Inputs close to
> ULONG_MAX wrap, so an excessive voltage limit can select register zero
> instead of 255.

I looked, it really doesn't matter.
The 'unrestricted unsigned long' comes from a write to a sysfs value.
Nothing will write a value that large unless they are trying to break
something, and they can just as well write "0".

David

> 
> Clamp to the 0..2040 mV register range before rounding to 8 mV units.
> 
> Fixes: 85f03bccd6e0 ("hwmon: Add support for Winbond W83L786NG/NR")
> ---
> Validation: x86-64 and i386 driver objects built with W=1.
> Source-extracted boundary tests passed on both word sizes;
> the corresponding test fails on the base revision. I/O is mocked.
> No physical sensor or booted-kernel testing was available.
> OpenAI Codex assisted analysis, code, tests and changelog drafting.
> Please review and add your own Signed-off-by before submitting.
> 
>  drivers/hwmon/w83l786ng.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
> index d16afda34e41..0cd545011e73 100644
> --- a/drivers/hwmon/w83l786ng.c
> +++ b/drivers/hwmon/w83l786ng.c
> @@ -101,7 +101,7 @@ static int temp_from_reg(int val)
>   * in mV as would be measured on the chip input pin, need to just
>   * multiply/divide by 8 to translate from/to register values.
>   */
> -#define IN_TO_REG(val)		(clamp_val((((val) + 4) / 8), 0, 255))
> +#define IN_TO_REG(val)		((clamp_val((val), 0, 2040) + 4) / 8)
>  #define IN_FROM_REG(val)	((val) * 8)
>  
>  #define DIV_FROM_REG(val)	(1 << (val))
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb