[lvc-project] [PATCH] hwmon (tmp401): fix overflow caused by default conversion rate value

[Guenter Roeck]

On Thu, Dec 11, 2025 at 07:43:43PM +0300, Alexey Simakov wrote:
> The driver computes conversion intervals using the formula:
> 
>     interval = (1 << (7 - rate)) * 125ms
> 
> where 'rate' is the sensor's conversion rate register value. According to
> the datasheet, the power-on reset value of this register is 0x8, which
> could be assigned to the register, after handling i2c general call.
> Using this default value causes a result greater than the bit width of
> left operand and an undefined behaviour in the calculation above, since
> shifting by values larger than the bit width is undefined behaviour as
> per C language standard.
> 
> Limit the maximum usable 'rate' value to 7 to prevent undefined
> behaviour in calculations.
> 
> Found by Linux Verification Center (linuxtesting.org) with Svace.
> 
> Fixes: ca53e7640de7 ("hwmon: (tmp401) Convert to _info API")
> Signed-off-by: Alexey Simakov <bigalex934 at gmail.com>

Applied.

It does not matter in practice, though, unless someone overwrites the chip
configuration from outside the driver. The register is initialized with a
value of 5 (500ms) when the driver is loaded, and the driver never writes
a bad value. I added that note to the commit message.

Thanks,
Guenter