From be89cf786d36f44d7765c572296fc9299afa428c Mon Sep 17 00:00:00 2001 From: Gui-Dong Han Date: Wed, 26 Nov 2025 19:35:42 +0800 Subject: [PATCH] hwmon: (lm87) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this causes Time-of-Check to Time-of-Use (TOCTOU) race conditions. Convert the macro to a static function. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Adhere to the principle of minimal changes by only converting macros that evaluate arguments multiple times and are used in lockless contexts. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251126113542.9968-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck --- drivers/hwmon/lm87.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/hwmon/lm87.c b/drivers/hwmon/lm87.c index d2d970e73c61..37bf2d1d3d09 100644 --- a/drivers/hwmon/lm87.c +++ b/drivers/hwmon/lm87.c @@ -116,8 +116,14 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A, 0x38, 0x2C }; (((val) < 0 ? (val) - 500 : \ (val) + 500) / 1000)) -#define FAN_FROM_REG(reg, div) ((reg) == 255 || (reg) == 0 ? 0 : \ - (1350000 + (reg)*(div) / 2) / ((reg) * (div))) +static int fan_from_reg(int reg, int div) +{ + if (reg == 255 || reg == 0) + return 0; + + return (1350000 + reg * div / 2) / (reg * div); +} + #define FAN_TO_REG(val, div) ((val) * (div) * 255 <= 1350000 ? 255 : \ (1350000 + (val)*(div) / 2) / ((val) * (div))) @@ -465,7 +471,7 @@ static ssize_t fan_input_show(struct device *dev, struct lm87_data *data = lm87_update_device(dev); int nr = to_sensor_dev_attr(attr)->index; - return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan[nr], + return sprintf(buf, "%d\n", fan_from_reg(data->fan[nr], FAN_DIV_FROM_REG(data->fan_div[nr]))); } @@ -475,7 +481,7 @@ static ssize_t fan_min_show(struct device *dev, struct device_attribute *attr, struct lm87_data *data = lm87_update_device(dev); int nr = to_sensor_dev_attr(attr)->index; - return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan_min[nr], + return sprintf(buf, "%d\n", fan_from_reg(data->fan_min[nr], FAN_DIV_FROM_REG(data->fan_div[nr]))); } @@ -534,7 +540,7 @@ static ssize_t fan_div_store(struct device *dev, return err; mutex_lock(&data->update_lock); - min = FAN_FROM_REG(data->fan_min[nr], + min = fan_from_reg(data->fan_min[nr], FAN_DIV_FROM_REG(data->fan_div[nr])); switch (val) {