linux-kernel - [PATCH] hwmon: (dell-smm) overflow check during multiplication

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251110152242.26-1-alsp705@gmail.com>
Date: Mon, 10 Nov 2025 18:22:41 +0300
From: Alexandr Sapozhnikov <alsp705@...il.com>
To: Pali Rohár <pali@...nel.org>,
	Jean Delvare <jdelvare@...e.com>,
	Guenter Roeck <linux@...ck-us.net>
Cc: Alexandr Sapozhnikov <alsp705@...il.com>,
	linux-hwmon@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] hwmon: (dell-smm) overflow check during multiplication

Added overflow checking when multiplying int by int and writing the result 
to long to prevent data corruption due to overflow.

Fixes: b1986c8e31a3 ("hwmon: (dell-smm) Add support for fanX_min, fanX_max and fanX_target")
Signed-off-by: Alexandr Sapozhnikov <alsp705@...il.com>
---
 drivers/hwmon/dell-smm-hwmon.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index 1572b5416015..ee2fe651c07f 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -34,6 +34,7 @@
 #include <linux/thermal.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
+#include <linux/limits.h>
 
 #include <linux/i8k.h>
 
@@ -736,6 +737,11 @@ static umode_t dell_smm_is_visible(const void *drvdata, enum hwmon_sensor_types
 	return 0;
 }
 
+static int dell_smm_check_overflow(int a, int b)
+{
+	return (long long)a * (long long)b > LONG_MAX;
+}
+
 static int dell_smm_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, int channel,
 			 long *val)
 {
@@ -769,12 +775,17 @@ static int dell_smm_read(struct device *dev, enum hwmon_sensor_types type, u32 a
 
 			return 0;
 		case hwmon_fan_min:
+			if (dell_smm_check_overflow(data->fan_nominal_speed[channel][0], mult)
+				return -EINVAL;
 			*val = data->fan_nominal_speed[channel][0] * mult;
 
 			return 0;
 		case hwmon_fan_max:
+			if (dell_smm_check_overflow(
+			    data->fan_nominal_speed[channel][data->i8k_fan_max], mult)
+				return -EINVAL;
 			*val = data->fan_nominal_speed[channel][data->i8k_fan_max] * mult;
-
+
 			return 0;
 		case hwmon_fan_target:
 			ret = i8k_get_fan_status(data, channel);
@@ -784,6 +795,8 @@ static int dell_smm_read(struct device *dev, enum hwmon_sensor_types type, u32 a
 			if (ret > data->i8k_fan_max)
 				ret = data->i8k_fan_max;
 
+			if (dell_smm_check_overflow(data->fan_nominal_speed[channel][ret], mult)
+				return -EINVAL;
 			*val = data->fan_nominal_speed[channel][ret] * mult;
 
 			return 0;
-- 
2.51.0