linux-kernel - [PATCH] hwmon: gpio-fan: fix set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260201-gpio-fan-set_rpm-retval-fix-v1-1-dc39bc7693ca@gmail.com>
Date: Sun, 01 Feb 2026 21:35:06 +0100
From: Gabor Juhos <j4g8y7@...il.com>
To: Guenter Roeck <linux@...ck-us.net>, 
 Alexander Stein <alexander.stein@...tq-group.com>
Cc: linux-hwmon@...r.kernel.org, linux-kernel@...r.kernel.org, 
 stable@...r.kernel.org, Gabor Juhos <j4g8y7@...il.com>
Subject: [PATCH] hwmon: gpio-fan: fix set_rpm() return value

The set_rpm function is used as a 'store' callback of a device attribute,
and as such it should return with the number of bytes consumed. However
since commit 0d01110e6356 ("hwmon: (gpio-fan) Add regulator support"),
the function returns with zero on success.

Due to this, the function gets called again and again whenever the user
tries to change the FAN speed by writing the desired RPM value into the
'fan1_target' sysfs attribute.

The broken behaviour can be reproduced easily. For example, the following
command never returns unless it gets terminated:

  $ echo 500 > /sys/class/hwmon/hwmon1/fan1_target
  ^C
  $

Change the code to return with the same value as the 'count' parameter
on success to indicate that all bytes from the input buffer are consumed.
The function behaved the same way prior to the offending change.

Cc: stable@...r.kernel.org
Fixes: 0d01110e6356 ("hwmon: (gpio-fan) Add regulator support")
Signed-off-by: Gabor Juhos <j4g8y7@...il.com>
---
 drivers/hwmon/gpio-fan.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
index 516c34bb61c9cfa2927d31ee6459c8306be2fb5b..d7fa021f376e39b79b6a0302377c4516f9861459 100644
--- a/drivers/hwmon/gpio-fan.c
+++ b/drivers/hwmon/gpio-fan.c
@@ -291,7 +291,7 @@ static ssize_t set_rpm(struct device *dev, struct device_attribute *attr,
 {
 	struct gpio_fan_data *fan_data = dev_get_drvdata(dev);
 	unsigned long rpm;
-	int ret = count;
+	int ret;

 	if (kstrtoul(buf, 10, &rpm))
 		return -EINVAL;
@@ -308,7 +308,7 @@ static ssize_t set_rpm(struct device *dev, struct device_attribute *attr,
 exit_unlock:
 	mutex_unlock(&fan_data->lock);

-	return ret;
+	return ret ? ret : count;
 }

 static DEVICE_ATTR_RW(pwm1);

---
base-commit: 1117702454262fb361869451be5b006c022eb08a
change-id: 20260201-gpio-fan-set_rpm-retval-fix-e6a7f103e0d5

Best regards,
-- 
Gabor Juhos <j4g8y7@...il.com>