Skip to content

Commit a4d01f3

Browse files
2045castorgroeck
authored andcommitted
hwmon: (adm1026) Convert macros to functions to avoid TOCTOU
The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this causes Time-of-Check to Time-of-Use (TOCTOU) race conditions. Convert the macro to a static function. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Adhere to the principle of minimal changes by only converting macros that evaluate arguments multiple times and are used in lockless contexts. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Link: https://lore.kernel.org/r/20251126113828.10003-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
1 parent 9eb4fb9 commit a4d01f3

1 file changed

Lines changed: 12 additions & 4 deletions

File tree

drivers/hwmon/adm1026.c

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -197,8 +197,16 @@ static int adm1026_scaling[] = { /* .001 Volts */
197197
#define FAN_TO_REG(val, div) ((val) <= 0 ? 0xff : \
198198
clamp_val(1350000 / ((val) * (div)), \
199199
1, 254))
200-
#define FAN_FROM_REG(val, div) ((val) == 0 ? -1 : (val) == 0xff ? 0 : \
201-
1350000 / ((val) * (div)))
200+
201+
static int fan_from_reg(int val, int div)
202+
{
203+
if (val == 0)
204+
return -1;
205+
if (val == 0xff)
206+
return 0;
207+
return 1350000 / (val * div);
208+
}
209+
202210
#define DIV_FROM_REG(val) (1 << (val))
203211
#define DIV_TO_REG(val) ((val) >= 8 ? 3 : (val) >= 4 ? 2 : (val) >= 2 ? 1 : 0)
204212

@@ -656,7 +664,7 @@ static ssize_t fan_show(struct device *dev, struct device_attribute *attr,
656664
struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr);
657665
int nr = sensor_attr->index;
658666
struct adm1026_data *data = adm1026_update_device(dev);
659-
return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan[nr],
667+
return sprintf(buf, "%d\n", fan_from_reg(data->fan[nr],
660668
data->fan_div[nr]));
661669
}
662670
static ssize_t fan_min_show(struct device *dev, struct device_attribute *attr,
@@ -665,7 +673,7 @@ static ssize_t fan_min_show(struct device *dev, struct device_attribute *attr,
665673
struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr);
666674
int nr = sensor_attr->index;
667675
struct adm1026_data *data = adm1026_update_device(dev);
668-
return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan_min[nr],
676+
return sprintf(buf, "%d\n", fan_from_reg(data->fan_min[nr],
669677
data->fan_div[nr]));
670678
}
671679
static ssize_t fan_min_store(struct device *dev,

0 commit comments

Comments
 (0)