From: Gui-Dong Han Date: Wed, 26 Nov 2025 11:38:28 +0000 (+0800) Subject: hwmon: (adm1026) Convert macros to functions to avoid TOCTOU X-Git-Tag: v6.19-rc1~148^2~7 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a4d01f3b02d0afb5e4497a1ec5d48da2a326d468;p=thirdparty%2Fkernel%2Flinux.git hwmon: (adm1026) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this causes Time-of-Check to Time-of-Use (TOCTOU) race conditions. Convert the macro to a static function. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Adhere to the principle of minimal changes by only converting macros that evaluate arguments multiple times and are used in lockless contexts. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251126113828.10003-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck --- diff --git a/drivers/hwmon/adm1026.c b/drivers/hwmon/adm1026.c index 80d09b017d3b7..c38c932e5d2af 100644 --- a/drivers/hwmon/adm1026.c +++ b/drivers/hwmon/adm1026.c @@ -197,8 +197,16 @@ static int adm1026_scaling[] = { /* .001 Volts */ #define FAN_TO_REG(val, div) ((val) <= 0 ? 0xff : \ clamp_val(1350000 / ((val) * (div)), \ 1, 254)) -#define FAN_FROM_REG(val, div) ((val) == 0 ? -1 : (val) == 0xff ? 0 : \ - 1350000 / ((val) * (div))) + +static int fan_from_reg(int val, int div) +{ + if (val == 0) + return -1; + if (val == 0xff) + return 0; + return 1350000 / (val * div); +} + #define DIV_FROM_REG(val) (1 << (val)) #define DIV_TO_REG(val) ((val) >= 8 ? 3 : (val) >= 4 ? 2 : (val) >= 2 ? 1 : 0) @@ -656,7 +664,7 @@ static ssize_t fan_show(struct device *dev, struct device_attribute *attr, struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr); int nr = sensor_attr->index; struct adm1026_data *data = adm1026_update_device(dev); - return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan[nr], + return sprintf(buf, "%d\n", fan_from_reg(data->fan[nr], data->fan_div[nr])); } static ssize_t fan_min_show(struct device *dev, struct device_attribute *attr, @@ -665,7 +673,7 @@ static ssize_t fan_min_show(struct device *dev, struct device_attribute *attr, struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr); int nr = sensor_attr->index; struct adm1026_data *data = adm1026_update_device(dev); - return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan_min[nr], + return sprintf(buf, "%d\n", fan_from_reg(data->fan_min[nr], data->fan_div[nr])); } static ssize_t fan_min_store(struct device *dev,