Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:
 "Several bug fixes in various drivers, plus a minor cleanup in the
  tmp103 driver"

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (tmp103) Remove duplicate test for I2C_FUNC_SMBUS_BYTE_DATA functionality
  hwmon: (w83793) Fix vrm write operation
  hwmon: (w83791d) Fix vrm write operation
  hwmon: (w83627hf) Fix vrm write operation
  hwmon: (vt1211) Fix vrm write operation
  hwmon: (pc87360) Fix vrm write operation
  hwmon: (lm87) Fix vrm write operation
  hwmon: (asb100) Fix vrm write operation
  hwmon: (adm1026) Fix vrm write operation
  hwmon: (adm1025) Fix vrm write operation
  hwmon: (hih6130) Fix missing hih6130->write_length setting
  hwmon: (dme1737) Prevent overflow problem when writing large limits
  hwmon: (emc6w201) Fix temperature limit range
  hwmon: (ads1015) Fix out-of-bounds array access
  hwmon: (lm92) Prevent overflow problem when writing large limits

15 files changed, 60 insertions, 31 deletions

diff --git a/drivers/hwmon/adm1025.c b/drivers/hwmon/adm1025.c
index d3d0e8cf27b4..d6c767ace916 100644
--- a/drivers/hwmon/adm1025.c
+++ b/drivers/hwmon/adm1025.c
@@ -382,6 +382,9 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr,
         if (err)
                 return err;
 
+        if (val > 255)
+                return -EINVAL;
+
         data->vrm = val;
         return count;
 }
diff --git a/drivers/hwmon/adm1026.c b/drivers/hwmon/adm1026.c
index ca8430f92564..e67b9a50ac7c 100644
--- a/drivers/hwmon/adm1026.c
+++ b/drivers/hwmon/adm1026.c
@@ -1085,6 +1085,9 @@ static ssize_t store_vrm_reg(struct device *dev, struct device_attribute *attr,
         if (err)
                 return err;
 
+        if (val > 255)
+                return -EINVAL;
+
         data->vrm = val;
         return count;
 }
diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c
index 22e0c926989d..126516414c11 100644
--- a/drivers/hwmon/ads1015.c
+++ b/drivers/hwmon/ads1015.c
@@ -212,6 +212,7 @@ static int ads1015_get_channels_config_of(struct i2c_client *client)
                                 dev_err(&client->dev,
                                         "invalid gain on %s\n",
                                         node->full_name);
+                                return -EINVAL;
                         }
                 }
 
@@ -222,6 +223,7 @@ static int ads1015_get_channels_config_of(struct i2c_client *client)
                                 dev_err(&client->dev,
                                         "invalid data_rate on %s\n",
                                         node->full_name);
+                                return -EINVAL;
                         }
                 }
 
diff --git a/drivers/hwmon/asb100.c b/drivers/hwmon/asb100.c
index f96063680e58..272fcc837ecc 100644
--- a/drivers/hwmon/asb100.c
+++ b/drivers/hwmon/asb100.c
@@ -510,6 +510,10 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr,
         err = kstrtoul(buf, 10, &val);
         if (err)
                 return err;
+
+        if (val > 255)
+                return -EINVAL;
+
         data->vrm = val;
         return count;
 }
diff --git a/drivers/hwmon/dme1737.c b/drivers/hwmon/dme1737.c
index 4ae3fff13f44..bea0a344fab5 100644
--- a/drivers/hwmon/dme1737.c
+++ b/drivers/hwmon/dme1737.c
@@ -247,8 +247,8 @@ struct dme1737_data {
         u8  pwm_acz[3];
         u8  pwm_freq[6];
         u8  pwm_rr[2];
-        u8  zone_low[3];
-        u8  zone_abs[3];
+        s8  zone_low[3];
+        s8  zone_abs[3];
         u8  zone_hyst[2];
         u32 alarms;
 };
@@ -277,7 +277,7 @@ static inline int IN_FROM_REG(int reg, int nominal, int res)
         return (reg * nominal + (3 << (res - 3))) / (3 << (res - 2));
 }
 
-static inline int IN_TO_REG(int val, int nominal)
+static inline int IN_TO_REG(long val, int nominal)
 {
         return clamp_val((val * 192 + nominal / 2) / nominal, 0, 255);
 }
@@ -293,7 +293,7 @@ static inline int TEMP_FROM_REG(int reg, int res)
         return (reg * 1000) >> (res - 8);
 }
 
-static inline int TEMP_TO_REG(int val)
+static inline int TEMP_TO_REG(long val)
 {
         return clamp_val((val < 0 ? val - 500 : val + 500) / 1000, -128, 127);
 }
@@ -308,7 +308,7 @@ static inline int TEMP_RANGE_FROM_REG(int reg)
         return TEMP_RANGE[(reg >> 4) & 0x0f];
 }
 
-static int TEMP_RANGE_TO_REG(int val, int reg)
+static int TEMP_RANGE_TO_REG(long val, int reg)
 {
         int i;
 
@@ -331,7 +331,7 @@ static inline int TEMP_HYST_FROM_REG(int reg, int ix)
         return (((ix == 1) ? reg : reg >> 4) & 0x0f) * 1000;
 }
 
-static inline int TEMP_HYST_TO_REG(int val, int ix, int reg)
+static inline int TEMP_HYST_TO_REG(long val, int ix, int reg)
 {
         int hyst = clamp_val((val + 500) / 1000, 0, 15);
 
@@ -347,7 +347,7 @@ static inline int FAN_FROM_REG(int reg, int tpc)
                 return (reg == 0 || reg == 0xffff) ? 0 : 90000 * 60 / reg;
 }
 
-static inline int FAN_TO_REG(int val, int tpc)
+static inline int FAN_TO_REG(long val, int tpc)
 {
         if (tpc) {
                 return clamp_val(val / tpc, 0, 0xffff);
@@ -379,7 +379,7 @@ static inline int FAN_TYPE_FROM_REG(int reg)
         return (edge > 0) ? 1 << (edge - 1) : 0;
 }
 
-static inline int FAN_TYPE_TO_REG(int val, int reg)
+static inline int FAN_TYPE_TO_REG(long val, int reg)
 {
         int edge = (val == 4) ? 3 : val;
 
@@ -402,7 +402,7 @@ static int FAN_MAX_FROM_REG(int reg)
         return 1000 + i * 500;
 }
 
-static int FAN_MAX_TO_REG(int val)
+static int FAN_MAX_TO_REG(long val)
 {
         int i;
 
@@ -460,7 +460,7 @@ static inline int PWM_ACZ_FROM_REG(int reg)
         return acz[(reg >> 5) & 0x07];
 }
 
-static inline int PWM_ACZ_TO_REG(int val, int reg)
+static inline int PWM_ACZ_TO_REG(long val, int reg)
 {
         int acz = (val == 4) ? 2 : val - 1;
 
@@ -476,7 +476,7 @@ static inline int PWM_FREQ_FROM_REG(int reg)
         return PWM_FREQ[reg & 0x0f];
 }
 
-static int PWM_FREQ_TO_REG(int val, int reg)
+static int PWM_FREQ_TO_REG(long val, int reg)
 {
         int i;
 
@@ -510,7 +510,7 @@ static inline int PWM_RR_FROM_REG(int reg, int ix)
         return (rr & 0x08) ? PWM_RR[rr & 0x07] : 0;
 }
 
-static int PWM_RR_TO_REG(int val, int ix, int reg)
+static int PWM_RR_TO_REG(long val, int ix, int reg)
 {
         int i;
 
@@ -528,7 +528,7 @@ static inline int PWM_RR_EN_FROM_REG(int reg, int ix)
         return PWM_RR_FROM_REG(reg, ix) ? 1 : 0;
 }
 
-static inline int PWM_RR_EN_TO_REG(int val, int ix, int reg)
+static inline int PWM_RR_EN_TO_REG(long val, int ix, int reg)
 {
         int en = (ix == 1) ? 0x80 : 0x08;
 
@@ -1481,13 +1481,16 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr,
                        const char *buf, size_t count)
 {
         struct dme1737_data *data = dev_get_drvdata(dev);
-        long val;
+        unsigned long val;
         int err;
 
-        err = kstrtol(buf, 10, &val);
+        err = kstrtoul(buf, 10, &val);
         if (err)
                 return err;
 
+        if (val > 255)
+                return -EINVAL;
+
         data->vrm = val;
         return count;
 }
diff --git a/drivers/hwmon/emc6w201.c b/drivers/hwmon/emc6w201.c
index e87da902f3ae..ada90716448d 100644
--- a/drivers/hwmon/emc6w201.c
+++ b/drivers/hwmon/emc6w201.c
@@ -252,12 +252,12 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *devattr,
         if (err < 0)
                 return err;
 
-        val /= 1000;
+        val = DIV_ROUND_CLOSEST(val, 1000);
         reg = (sf == min) ? EMC6W201_REG_TEMP_LOW(nr)
                           : EMC6W201_REG_TEMP_HIGH(nr);
 
         mutex_lock(&data->update_lock);
-        data->temp[sf][nr] = clamp_val(val, -127, 128);
+        data->temp[sf][nr] = clamp_val(val, -127, 127);
         err = emc6w201_write8(client, reg, data->temp[sf][nr]);
         mutex_unlock(&data->update_lock);
 
diff --git a/drivers/hwmon/hih6130.c b/drivers/hwmon/hih6130.c
index 0e01c4e13e33..7b73d2002d3e 100644
--- a/drivers/hwmon/hih6130.c
+++ b/drivers/hwmon/hih6130.c
@@ -238,6 +238,9 @@ static int hih6130_probe(struct i2c_client *client,
         hih6130->client = client;
         mutex_init(&hih6130->lock);
 
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_QUICK))
+                hih6130->write_length = 1;
+
         hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
                                                            hih6130,
                                                            hih6130_groups);
diff --git a/drivers/hwmon/lm87.c b/drivers/hwmon/lm87.c
index ba1d83d48056..a5e295826aea 100644
--- a/drivers/hwmon/lm87.c
+++ b/drivers/hwmon/lm87.c
@@ -617,6 +617,10 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr,
         err = kstrtoul(buf, 10, &val);
         if (err)
                 return err;
+
+        if (val > 255)
+                return -EINVAL;
+
         data->vrm = val;
         return count;
 }
diff --git a/drivers/hwmon/lm92.c b/drivers/hwmon/lm92.c
index d2060e245ff5..cfaf70b9cba7 100644
--- a/drivers/hwmon/lm92.c
+++ b/drivers/hwmon/lm92.c
@@ -74,12 +74,9 @@ static inline int TEMP_FROM_REG(s16 reg)
         return reg / 8 * 625 / 10;
 }
 
-static inline s16 TEMP_TO_REG(int val)
+static inline s16 TEMP_TO_REG(long val)
 {
-        if (val <= -60000)
-                return -60000 * 10 / 625 * 8;
-        if (val >= 160000)
-                return 160000 * 10 / 625 * 8;
+        val = clamp_val(val, -60000, 160000);
         return val * 10 / 625 * 8;
 }
 
@@ -206,10 +203,12 @@ static ssize_t set_temp_hyst(struct device *dev,
         if (err)
                 return err;
 
+        val = clamp_val(val, -120000, 220000);
         mutex_lock(&data->update_lock);
-        data->temp[t_hyst] = TEMP_FROM_REG(data->temp[attr->index]) - val;
+         data->temp[t_hyst] =
+                TEMP_TO_REG(TEMP_FROM_REG(data->temp[attr->index]) - val);
         i2c_smbus_write_word_swapped(client, LM92_REG_TEMP_HYST,
-                                     TEMP_TO_REG(data->temp[t_hyst]));
+                                     data->temp[t_hyst]);
         mutex_unlock(&data->update_lock);
         return count;
 }
diff --git a/drivers/hwmon/pc87360.c b/drivers/hwmon/pc87360.c
index 988181e4cfcd..145f674c1d87 100644
--- a/drivers/hwmon/pc87360.c
+++ b/drivers/hwmon/pc87360.c
@@ -615,6 +615,9 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr,
         if (err)
                 return err;
 
+        if (val > 255)
+                return -EINVAL;
+
         data->vrm = val;
         return count;
 }
diff --git a/drivers/hwmon/tmp103.c b/drivers/hwmon/tmp103.c
index c74d2da389d9..e42964f07f67 100644
--- a/drivers/hwmon/tmp103.c
+++ b/drivers/hwmon/tmp103.c
@@ -131,13 +131,6 @@ static int tmp103_probe(struct i2c_client *client,
         struct regmap *regmap;
         int ret;
 
-        if (!i2c_check_functionality(client->adapter,
-                                     I2C_FUNC_SMBUS_BYTE_DATA)) {
-                dev_err(&client->dev,
-                        "adapter doesn't support SMBus byte transactions\n");
-                return -ENODEV;
-        }
-
         regmap = devm_regmap_init_i2c(client, &tmp103_regmap_config);
         if (IS_ERR(regmap)) {
                 dev_err(dev, "failed to allocate register map\n");
diff --git a/drivers/hwmon/vt1211.c b/drivers/hwmon/vt1211.c
index 344b22ec2553..3ea57c3504e2 100644
--- a/drivers/hwmon/vt1211.c
+++ b/drivers/hwmon/vt1211.c
@@ -879,6 +879,9 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr,
         if (err)
                 return err;
 
+        if (val > 255)
+                return -EINVAL;
+
         data->vrm = val;
 
         return count;
diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
index c1726be3654c..2f55973a8c4c 100644
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -820,6 +820,9 @@ store_vrm_reg(struct device *dev, struct device_attribute *attr, const char *buf
         err = kstrtoul(buf, 10, &val);
         if (err)
                 return err;
+
+        if (val > 255)
+                return -EINVAL;
         data->vrm = val;
 
         return count;
diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
index cb3765fec98c..001df856913f 100644
--- a/drivers/hwmon/w83791d.c
+++ b/drivers/hwmon/w83791d.c
@@ -1181,6 +1181,9 @@ static ssize_t store_vrm_reg(struct device *dev,
         if (err)
                 return err;
 
+        if (val > 255)
+                return -EINVAL;
+
         data->vrm = val;
         return count;
 }
diff --git a/drivers/hwmon/w83793.c b/drivers/hwmon/w83793.c
index 9d63d71214ca..816aa6caf5d5 100644
--- a/drivers/hwmon/w83793.c
+++ b/drivers/hwmon/w83793.c
@@ -353,6 +353,9 @@ store_vrm(struct device *dev, struct device_attribute *attr,
         if (err)
                 return err;
 
+        if (val > 255)
+                return -EINVAL;
+
         data->vrm = val;
         return count;
 }