Skip to content

Commit d56e460

Browse files
groeckgroeck
committed
hwmon: (nct6775) Fix access to temperature configuration registers
The number of temperature configuration registers does not always match the total number of temperature registers. This can result in access errors reported if KASAN is enabled. BUG: KASAN: global-out-of-bounds in nct6775_probe+0x5654/0x6fe9 nct6775_core Reported-by: Erhard Furtner <[email protected]> Closes: https://lore.kernel.org/linux-hwmon/[email protected]/ Fixes: b7f1f7b ("hwmon: (nct6775) Additional TEMP registers for nct6799") Cc: Ahmad Khalifa <[email protected]> Tested-by: Ahmad Khalifa <[email protected]> Signed-off-by: Guenter Roeck <[email protected]>
1 parent 841c351 commit d56e460

File tree

1 file changed

+12
-2
lines changed

1 file changed

+12
-2
lines changed

‎drivers/hwmon/nct6775-core.c

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3512,6 +3512,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
35123512
const u16 *reg_temp_mon, *reg_temp_alternate, *reg_temp_crit;
35133513
const u16 *reg_temp_crit_l = NULL, *reg_temp_crit_h = NULL;
35143514
int num_reg_temp, num_reg_temp_mon, num_reg_tsi_temp;
3515+
int num_reg_temp_config;
35153516
struct device *hwmon_dev;
35163517
struct sensor_template_group tsi_temp_tg;
35173518

@@ -3594,6 +3595,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
35943595
reg_temp_over = NCT6106_REG_TEMP_OVER;
35953596
reg_temp_hyst = NCT6106_REG_TEMP_HYST;
35963597
reg_temp_config = NCT6106_REG_TEMP_CONFIG;
3598+
num_reg_temp_config = ARRAY_SIZE(NCT6106_REG_TEMP_CONFIG);
35973599
reg_temp_alternate = NCT6106_REG_TEMP_ALTERNATE;
35983600
reg_temp_crit = NCT6106_REG_TEMP_CRIT;
35993601
reg_temp_crit_l = NCT6106_REG_TEMP_CRIT_L;
@@ -3669,6 +3671,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
36693671
reg_temp_over = NCT6106_REG_TEMP_OVER;
36703672
reg_temp_hyst = NCT6106_REG_TEMP_HYST;
36713673
reg_temp_config = NCT6106_REG_TEMP_CONFIG;
3674+
num_reg_temp_config = ARRAY_SIZE(NCT6106_REG_TEMP_CONFIG);
36723675
reg_temp_alternate = NCT6106_REG_TEMP_ALTERNATE;
36733676
reg_temp_crit = NCT6106_REG_TEMP_CRIT;
36743677
reg_temp_crit_l = NCT6106_REG_TEMP_CRIT_L;
@@ -3746,6 +3749,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
37463749
reg_temp_over = NCT6775_REG_TEMP_OVER;
37473750
reg_temp_hyst = NCT6775_REG_TEMP_HYST;
37483751
reg_temp_config = NCT6775_REG_TEMP_CONFIG;
3752+
num_reg_temp_config = ARRAY_SIZE(NCT6775_REG_TEMP_CONFIG);
37493753
reg_temp_alternate = NCT6775_REG_TEMP_ALTERNATE;
37503754
reg_temp_crit = NCT6775_REG_TEMP_CRIT;
37513755

@@ -3821,6 +3825,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
38213825
reg_temp_over = NCT6775_REG_TEMP_OVER;
38223826
reg_temp_hyst = NCT6775_REG_TEMP_HYST;
38233827
reg_temp_config = NCT6776_REG_TEMP_CONFIG;
3828+
num_reg_temp_config = ARRAY_SIZE(NCT6776_REG_TEMP_CONFIG);
38243829
reg_temp_alternate = NCT6776_REG_TEMP_ALTERNATE;
38253830
reg_temp_crit = NCT6776_REG_TEMP_CRIT;
38263831

@@ -3900,6 +3905,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
39003905
reg_temp_over = NCT6779_REG_TEMP_OVER;
39013906
reg_temp_hyst = NCT6779_REG_TEMP_HYST;
39023907
reg_temp_config = NCT6779_REG_TEMP_CONFIG;
3908+
num_reg_temp_config = ARRAY_SIZE(NCT6779_REG_TEMP_CONFIG);
39033909
reg_temp_alternate = NCT6779_REG_TEMP_ALTERNATE;
39043910
reg_temp_crit = NCT6779_REG_TEMP_CRIT;
39053911

@@ -4034,6 +4040,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
40344040
reg_temp_over = NCT6779_REG_TEMP_OVER;
40354041
reg_temp_hyst = NCT6779_REG_TEMP_HYST;
40364042
reg_temp_config = NCT6779_REG_TEMP_CONFIG;
4043+
num_reg_temp_config = ARRAY_SIZE(NCT6779_REG_TEMP_CONFIG);
40374044
reg_temp_alternate = NCT6779_REG_TEMP_ALTERNATE;
40384045
reg_temp_crit = NCT6779_REG_TEMP_CRIT;
40394046

@@ -4123,6 +4130,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
41234130
reg_temp_over = NCT6798_REG_TEMP_OVER;
41244131
reg_temp_hyst = NCT6798_REG_TEMP_HYST;
41254132
reg_temp_config = NCT6779_REG_TEMP_CONFIG;
4133+
num_reg_temp_config = ARRAY_SIZE(NCT6779_REG_TEMP_CONFIG);
41264134
reg_temp_alternate = NCT6798_REG_TEMP_ALTERNATE;
41274135
reg_temp_crit = NCT6798_REG_TEMP_CRIT;
41284136

@@ -4204,7 +4212,8 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
42044212
= reg_temp_crit[src - 1];
42054213
if (reg_temp_crit_l && reg_temp_crit_l[i])
42064214
data->reg_temp[4][src - 1] = reg_temp_crit_l[i];
4207-
data->reg_temp_config[src - 1] = reg_temp_config[i];
4215+
if (i < num_reg_temp_config)
4216+
data->reg_temp_config[src - 1] = reg_temp_config[i];
42084217
data->temp_src[src - 1] = src;
42094218
continue;
42104219
}
@@ -4217,7 +4226,8 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
42174226
data->reg_temp[0][s] = reg_temp[i];
42184227
data->reg_temp[1][s] = reg_temp_over[i];
42194228
data->reg_temp[2][s] = reg_temp_hyst[i];
4220-
data->reg_temp_config[s] = reg_temp_config[i];
4229+
if (i < num_reg_temp_config)
4230+
data->reg_temp_config[s] = reg_temp_config[i];
42214231
if (reg_temp_crit_h && reg_temp_crit_h[i])
42224232
data->reg_temp[3][s] = reg_temp_crit_h[i];
42234233
else if (reg_temp_crit[src - 1])

0 commit comments

Comments
 (0)