Commit 76d885a1 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hwmon-for-v6.8-rc6' of... 

Merge tag 'hwmon-for-v6.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fix from Guenter Roeck:
 "Fix a global-out-of-bounds bug in nct6775 driver"

* tag 'hwmon-for-v6.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (nct6775) Fix access to temperature configuration registers
parents ffd2cb6b d56e460e

drivers/hwmon/nct6775-core.c

+12 −2
Original line number Diff line number Diff line
@@ -3512,6 +3512,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
	const u16 *reg_temp_mon, *reg_temp_alternate, *reg_temp_crit;

	const u16 *reg_temp_crit_l = NULL, *reg_temp_crit_h = NULL;

	int num_reg_temp, num_reg_temp_mon, num_reg_tsi_temp;

	int num_reg_temp_config;

	struct device *hwmon_dev;

	struct sensor_template_group tsi_temp_tg;
@@ -3594,6 +3595,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6106_REG_TEMP_OVER;

		reg_temp_hyst = NCT6106_REG_TEMP_HYST;

		reg_temp_config = NCT6106_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6106_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6106_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6106_REG_TEMP_CRIT;

		reg_temp_crit_l = NCT6106_REG_TEMP_CRIT_L;
@@ -3669,6 +3671,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6106_REG_TEMP_OVER;

		reg_temp_hyst = NCT6106_REG_TEMP_HYST;

		reg_temp_config = NCT6106_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6106_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6106_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6106_REG_TEMP_CRIT;

		reg_temp_crit_l = NCT6106_REG_TEMP_CRIT_L;
@@ -3746,6 +3749,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6775_REG_TEMP_OVER;

		reg_temp_hyst = NCT6775_REG_TEMP_HYST;

		reg_temp_config = NCT6775_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6775_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6775_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6775_REG_TEMP_CRIT;
@@ -3821,6 +3825,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6775_REG_TEMP_OVER;

		reg_temp_hyst = NCT6775_REG_TEMP_HYST;

		reg_temp_config = NCT6776_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6776_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6776_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6776_REG_TEMP_CRIT;
@@ -3900,6 +3905,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6779_REG_TEMP_OVER;

		reg_temp_hyst = NCT6779_REG_TEMP_HYST;

		reg_temp_config = NCT6779_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6779_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6779_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6779_REG_TEMP_CRIT;
@@ -4034,6 +4040,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6779_REG_TEMP_OVER;

		reg_temp_hyst = NCT6779_REG_TEMP_HYST;

		reg_temp_config = NCT6779_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6779_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6779_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6779_REG_TEMP_CRIT;
@@ -4123,6 +4130,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6798_REG_TEMP_OVER;

		reg_temp_hyst = NCT6798_REG_TEMP_HYST;

		reg_temp_config = NCT6779_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6779_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6798_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6798_REG_TEMP_CRIT;
@@ -4204,6 +4212,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
				  = reg_temp_crit[src - 1];

			if (reg_temp_crit_l && reg_temp_crit_l[i])

				data->reg_temp[4][src - 1] = reg_temp_crit_l[i];

			if (i < num_reg_temp_config)

				data->reg_temp_config[src - 1] = reg_temp_config[i];

			data->temp_src[src - 1] = src;

			continue;
@@ -4217,6 +4226,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		data->reg_temp[0][s] = reg_temp[i];

		data->reg_temp[1][s] = reg_temp_over[i];

		data->reg_temp[2][s] = reg_temp_hyst[i];

		if (i < num_reg_temp_config)

			data->reg_temp_config[s] = reg_temp_config[i];

		if (reg_temp_crit_h && reg_temp_crit_h[i])

			data->reg_temp[3][s] = reg_temp_crit_h[i];