Commit d56e460e authored by Guenter Roeck's avatar Guenter Roeck
Browse files

hwmon: (nct6775) Fix access to temperature configuration registers 



The number of temperature configuration registers does
not always match the total number of temperature registers.
This can result in access errors reported if KASAN is enabled.

BUG: KASAN: global-out-of-bounds in nct6775_probe+0x5654/0x6fe9 nct6775_core

Reported-by: default avatarErhard Furtner <erhard_f@mailbox.org>
Closes: https://lore.kernel.org/linux-hwmon/d51181d1-d26b-42b2-b002-3f5a4037721f@roeck-us.net/


Fixes: b7f1f7b2 ("hwmon: (nct6775) Additional TEMP registers for nct6799")
Cc: Ahmad Khalifa <ahmad@khalifa.ws>
Tested-by: default avatarAhmad Khalifa <ahmad@khalifa.ws>
Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
parent 841c3516

drivers/hwmon/nct6775-core.c

+12 −2
Original line number Diff line number Diff line
@@ -3512,6 +3512,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
	const u16 *reg_temp_mon, *reg_temp_alternate, *reg_temp_crit;

	const u16 *reg_temp_crit_l = NULL, *reg_temp_crit_h = NULL;

	int num_reg_temp, num_reg_temp_mon, num_reg_tsi_temp;

	int num_reg_temp_config;

	struct device *hwmon_dev;

	struct sensor_template_group tsi_temp_tg;
@@ -3594,6 +3595,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6106_REG_TEMP_OVER;

		reg_temp_hyst = NCT6106_REG_TEMP_HYST;

		reg_temp_config = NCT6106_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6106_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6106_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6106_REG_TEMP_CRIT;

		reg_temp_crit_l = NCT6106_REG_TEMP_CRIT_L;
@@ -3669,6 +3671,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6106_REG_TEMP_OVER;

		reg_temp_hyst = NCT6106_REG_TEMP_HYST;

		reg_temp_config = NCT6106_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6106_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6106_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6106_REG_TEMP_CRIT;

		reg_temp_crit_l = NCT6106_REG_TEMP_CRIT_L;
@@ -3746,6 +3749,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6775_REG_TEMP_OVER;

		reg_temp_hyst = NCT6775_REG_TEMP_HYST;

		reg_temp_config = NCT6775_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6775_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6775_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6775_REG_TEMP_CRIT;
@@ -3821,6 +3825,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6775_REG_TEMP_OVER;

		reg_temp_hyst = NCT6775_REG_TEMP_HYST;

		reg_temp_config = NCT6776_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6776_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6776_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6776_REG_TEMP_CRIT;
@@ -3900,6 +3905,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6779_REG_TEMP_OVER;

		reg_temp_hyst = NCT6779_REG_TEMP_HYST;

		reg_temp_config = NCT6779_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6779_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6779_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6779_REG_TEMP_CRIT;
@@ -4034,6 +4040,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6779_REG_TEMP_OVER;

		reg_temp_hyst = NCT6779_REG_TEMP_HYST;

		reg_temp_config = NCT6779_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6779_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6779_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6779_REG_TEMP_CRIT;
@@ -4123,6 +4130,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		reg_temp_over = NCT6798_REG_TEMP_OVER;

		reg_temp_hyst = NCT6798_REG_TEMP_HYST;

		reg_temp_config = NCT6779_REG_TEMP_CONFIG;

		num_reg_temp_config = ARRAY_SIZE(NCT6779_REG_TEMP_CONFIG);

		reg_temp_alternate = NCT6798_REG_TEMP_ALTERNATE;

		reg_temp_crit = NCT6798_REG_TEMP_CRIT;
@@ -4204,6 +4212,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
				  = reg_temp_crit[src - 1];

			if (reg_temp_crit_l && reg_temp_crit_l[i])

				data->reg_temp[4][src - 1] = reg_temp_crit_l[i];

			if (i < num_reg_temp_config)

				data->reg_temp_config[src - 1] = reg_temp_config[i];

			data->temp_src[src - 1] = src;

			continue;
@@ -4217,6 +4226,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, 
		data->reg_temp[0][s] = reg_temp[i];

		data->reg_temp[1][s] = reg_temp_over[i];

		data->reg_temp[2][s] = reg_temp_hyst[i];

		if (i < num_reg_temp_config)

			data->reg_temp_config[s] = reg_temp_config[i];

		if (reg_temp_crit_h && reg_temp_crit_h[i])

			data->reg_temp[3][s] = reg_temp_crit_h[i];