[PATCH v2] iio: temperature: mcp9600: Bound thresholds before scaling

[PATCH v2] iio: temperature: mcp9600: Bound thresholds before scaling

[Zhu Jun]

mcp9600_write_thresh() multiplies the integer part by 1000000 before
clamping to the supported temperature range. The multiplication can
overflow int, so a request such as 3000 degrees can select the lower
threshold instead of the upper threshold.

Clamp the integer part to the hot-junction range before scaling. Keep
the existing final clamp for fractional values and the narrower cold-
junction range.

Fixes: dea750f8015b ("iio: temperature: mcp9600: add threshold events support")
Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
Changes in v2:
- Use MICRO from <linux/units.h>, cast to int to preserve
  signed division for the negative temperature limit (Andy Shevchenko).

 drivers/iio/temperature/mcp9600.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/temperature/mcp9600.c b/drivers/iio/temperature/mcp9600.c
index b0ff0c7b4891..d030f639f500 100644
--- a/drivers/iio/temperature/mcp9600.c
+++ b/drivers/iio/temperature/mcp9600.c
@@ -17,6 +17,7 @@
 #include <linux/math.h>
 #include <linux/minmax.h>
 #include <linux/module.h>
+#include <linux/units.h>
 
 #include <linux/iio/events.h>
 #include <linux/iio/iio.h>
@@ -326,6 +327,8 @@ static int mcp9600_write_thresh(struct iio_dev *indio_dev,
 	i = mcp9600_get_alert_index(chan->channel2, dir);
 	switch (info) {
 	case IIO_EV_INFO_VALUE:
+		val = clamp_val(val, MCP9600_MIN_TEMP_HOT_JUNCTION_MICRO / (int)MICRO,
+				MCP9600_MAX_TEMP_HOT_JUNCTION_MICRO / (int)MICRO);
 		/* Scale value to include decimal part into calculations */
 		s_val = (val < 0) ? ((val * 1000000) - val2) :
 				    ((val * 1000000) + val2);
-- 
2.51.0

Re: [PATCH v2] iio: temperature: mcp9600: Bound thresholds before scaling

[Andy Shevchenko]

On Wed, Nov 11, 2026 at 11:42:24AM +0800, Zhu Jun wrote:
> mcp9600_write_thresh() multiplies the integer part by 1000000 before
> clamping to the supported temperature range. The multiplication can
> overflow int, so a request such as 3000 degrees can select the lower
> threshold instead of the upper threshold.
> 
> Clamp the integer part to the hot-junction range before scaling. Keep
> the existing final clamp for fractional values and the narrower cold-
> junction range.

...

> +		val = clamp_val(val, MCP9600_MIN_TEMP_HOT_JUNCTION_MICRO / (int)MICRO,

Btw, why do we need to use _val() variant of clamp*()?

> +				MCP9600_MAX_TEMP_HOT_JUNCTION_MICRO / (int)MICRO);

-- 
With Best Regards,
Andy Shevchenko

[PATCH v2] iio: temperature: mcp9600: Bound thresholds before scaling

[Zhu Jun]

mcp9600_write_thresh() multiplies the integer part by 1000000 before
clamping to the supported temperature range. The multiplication can
overflow int, so a request such as 3000 degrees can select the lower
threshold instead of the upper threshold.

Clamp the integer part to the hot-junction range before scaling. Keep
the existing final clamp for fractional values and the narrower cold-
junction range.

Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
Changes in v2:
- Use MICRO from <linux/units.h>, cast to int to preserve
  signed division for the negative temperature limit (Andy Shevchenko).

 drivers/iio/temperature/mcp9600.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/temperature/mcp9600.c b/drivers/iio/temperature/mcp9600.c
index b0ff0c7b4891..d030f639f500 100644
--- a/drivers/iio/temperature/mcp9600.c
+++ b/drivers/iio/temperature/mcp9600.c
@@ -17,6 +17,7 @@
 #include <linux/math.h>
 #include <linux/minmax.h>
 #include <linux/module.h>
+#include <linux/units.h>
 
 #include <linux/iio/events.h>
 #include <linux/iio/iio.h>
@@ -326,6 +327,8 @@ static int mcp9600_write_thresh(struct iio_dev *indio_dev,
 	i = mcp9600_get_alert_index(chan->channel2, dir);
 	switch (info) {
 	case IIO_EV_INFO_VALUE:
+		val = clamp_val(val, MCP9600_MIN_TEMP_HOT_JUNCTION_MICRO / (int)MICRO,
+				MCP9600_MAX_TEMP_HOT_JUNCTION_MICRO / (int)MICRO);
 		/* Scale value to include decimal part into calculations */
 		s_val = (val < 0) ? ((val * 1000000) - val2) :
 				    ((val * 1000000) + val2);
-- 
2.51.0

Re: [PATCH v2] iio: temperature: mcp9600: Bound thresholds before scaling

[Andy Shevchenko]

On Wed, Nov 11, 2026 at 11:05:38AM +0800, Zhu Jun wrote:
> mcp9600_write_thresh() multiplies the integer part by 1000000 before
> clamping to the supported temperature range. The multiplication can
> overflow int, so a request such as 3000 degrees can select the lower
> threshold instead of the upper threshold.
> 
> Clamp the integer part to the hot-junction range before scaling. Keep
> the existing final clamp for fractional values and the narrower cold-
> junction range.

...

> +		val = clamp_val(val, MCP9600_MIN_TEMP_HOT_JUNCTION_MICRO / (int)MICRO,

Btw, why do we need to use _val() variant of clamp*()?

> +				MCP9600_MAX_TEMP_HOT_JUNCTION_MICRO / (int)MICRO);

-- 
With Best Regards,
Andy Shevchenko