Skip to content

Commit 13a0f02

Browse files
Sanman Pradhangregkh
authored andcommitted
hwmon: (ltc2992) Fix u32 overflow in power read path
commit 2da0c1f upstream. ltc2992_get_power() computes the divisor for mul_u64_u32_div() as r_sense_uohm * 1000. This multiplication overflows u32 when r_sense_uohm exceeds about 4.29 ohms (4294967 micro-ohms), producing a truncated divisor and an incorrect power reading. Cancel the factor of 1000 from both the numerator (VADC_UV_LSB * IADC_NANOV_LSB = 312500000) and the divisor (r_sense_uohm * 1000), giving (VADC_UV_LSB / 1000) * IADC_NANOV_LSB = 312500 as the numerator and plain r_sense_uohm as the divisor. The cancellation is exact because LTC2992_VADC_UV_LSB (25000) is divisible by 1000. This is the read-path counterpart of the write-path fix applied in the preceding patch. Fixes: b0bd407 ("hwmon: (ltc2992) Add support") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan <psanman@juniper.net> Link: https://lore.kernel.org/r/20260416215904.101969-3-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 357ef14 commit 13a0f02

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

drivers/hwmon/ltc2992.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -637,8 +637,10 @@ static int ltc2992_get_power(struct ltc2992_state *st, u32 reg, u32 channel, lon
637637
if (reg_val < 0)
638638
return reg_val;
639639

640-
*val = mul_u64_u32_div(reg_val, LTC2992_VADC_UV_LSB * LTC2992_IADC_NANOV_LSB,
641-
st->r_sense_uohm[channel] * 1000);
640+
*val = mul_u64_u32_div(reg_val,
641+
LTC2992_VADC_UV_LSB / 1000 *
642+
LTC2992_IADC_NANOV_LSB,
643+
st->r_sense_uohm[channel]);
642644

643645
return 0;
644646
}

0 commit comments

Comments
 (0)