linux-kernel - Re: [PATCH] hwmon (tmp401): fix overflow caused by default conversion rate value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3d7ad463-a9e7-46c7-9823-1c76fd792099@roeck-us.net>
Date: Sun, 14 Dec 2025 09:49:27 -0800
From: Guenter Roeck <linux@...ck-us.net>
To: Alexey Simakov <bigalex934@...il.com>
Cc: linux-hwmon@...r.kernel.org, linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org
Subject: Re: [PATCH] hwmon (tmp401): fix overflow caused by default
 conversion rate value

On Thu, Dec 11, 2025 at 07:43:43PM +0300, Alexey Simakov wrote:
> The driver computes conversion intervals using the formula:
> 
>     interval = (1 << (7 - rate)) * 125ms
> 
> where 'rate' is the sensor's conversion rate register value. According to
> the datasheet, the power-on reset value of this register is 0x8, which
> could be assigned to the register, after handling i2c general call.
> Using this default value causes a result greater than the bit width of
> left operand and an undefined behaviour in the calculation above, since
> shifting by values larger than the bit width is undefined behaviour as
> per C language standard.
> 
> Limit the maximum usable 'rate' value to 7 to prevent undefined
> behaviour in calculations.
> 
> Found by Linux Verification Center (linuxtesting.org) with Svace.
> 
> Fixes: ca53e7640de7 ("hwmon: (tmp401) Convert to _info API")
> Signed-off-by: Alexey Simakov <bigalex934@...il.com>

Applied.

It does not matter in practice, though, unless someone overwrites the chip
configuration from outside the driver. The register is initialized with a
value of 5 (500ms) when the driver is loaded, and the driver never writes
a bad value. I added that note to the commit message.

Thanks,
Guenter