[PATCH] hwmon: (ftsteutates) Fix potential memory access error

[PATCH] hwmon: (ftsteutates) Fix potential memory access error

[Guenter Roeck]

Using set_bit() to set a bit in an integer is not a good idea, since
the function expects an unsigned long as argument, which can be 64 bit
wide. Coverity reports this problem as

>>>     CID 1364488:  Memory - illegal accesses  (INCOMPATIBLE_CAST)
>>>     Pointer "&ret" points to an object whose effective type is "int"
>>>	(32 bits, signed) but is dereferenced as a wider "unsigned
+long" (64 bits, unsigned).  This may lead to memory corruption.
245                     set_bit(1, (unsigned long *)&ret);

Just use BIT instead.

Cc: Thilo Cestonaro <thilo@cestona.ro>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/ftsteutates.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/ftsteutates.c b/drivers/hwmon/ftsteutates.c
index 2b2ff67026be..48633e541dc3 100644
--- a/drivers/hwmon/ftsteutates.c
+++ b/drivers/hwmon/ftsteutates.c
@@ -242,7 +242,7 @@ static int fts_wd_set_resolution(struct fts_data *data,
 	}
 
 	if (resolution == seconds)
-		set_bit(1, (unsigned long *)&ret);
+		ret |= BIT(1);
 	else
 		ret &= ~BIT(1);
 
-- 
2.5.0

[PATCH] hwmon: (lm75) Improve error handling

[Guenter Roeck]

Use devm_add_action_or_reset() instead of devm_add_action(), and
check its return value.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/lm75.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
index 547a9c87c68c..92f9d4bbf597 100644
--- a/drivers/hwmon/lm75.c
+++ b/drivers/hwmon/lm75.c
@@ -220,7 +220,7 @@ lm75_probe(struct i2c_client *client, const struct i2c_device_id *id)
 	struct device *dev = &client->dev;
 	struct device *hwmon_dev;
 	struct lm75_data *data;
-	int status;
+	int status, err;
 	u8 set_mask, clr_mask;
 	int new;
 	enum lm75_type kind = id->driver_data;
@@ -331,7 +331,9 @@ lm75_probe(struct i2c_client *client, const struct i2c_device_id *id)
 	if (status != new)
 		i2c_smbus_write_byte_data(client, LM75_REG_CONF, new);
 
-	devm_add_action(dev, lm75_remove, data);
+	err = devm_add_action_or_reset(dev, lm75_remove, data);
+	if (err)
+		return err;
 
 	dev_dbg(dev, "Config %02x\n", new);
 
-- 
2.5.0

[PATCH] hwmon: (lm90) Improve error handling

[Guenter Roeck]

Replace devm_add_action() with devm_add_action_or_reset(),
and check its return value.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/lm90.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index 7b3eedf76c62..fa15f7238a28 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -1551,9 +1551,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)
 	if (config != data->config_orig) /* Only write if changed */
 		i2c_smbus_write_byte_data(client, LM90_REG_W_CONFIG1, config);
 
-	devm_add_action(&client->dev, lm90_restore_conf, data);
-
-	return 0;
+	return devm_add_action_or_reset(&client->dev, lm90_restore_conf, data);
 }
 
 static bool lm90_is_tripped(struct i2c_client *client, u16 *status)
@@ -1640,7 +1638,9 @@ static int lm90_probe(struct i2c_client *client,
 		return err;
 	}
 
-	devm_add_action(dev, lm90_regulator_disable, regulator);
+	err = devm_add_action_or_reset(dev, lm90_regulator_disable, regulator);
+	if (err)
+		return err;
 
 	data = devm_kzalloc(dev, sizeof(struct lm90_data), GFP_KERNEL);
 	if (!data)
@@ -1696,7 +1696,9 @@ static int lm90_probe(struct i2c_client *client,
 		err = device_create_file(dev, &dev_attr_pec);
 		if (err)
 			return err;
-		devm_add_action(dev, lm90_remove_pec, dev);
+		err = devm_add_action_or_reset(dev, lm90_remove_pec, dev);
+		if (err)
+			return err;
 	}
 
 	hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
-- 
2.5.0

Re: [PATCH] hwmon: (lm90) Improve error handling

[Jean Delvare]

Hi Guenter,

On Tue, 26 Jul 2016 08:19:47 -0700, Guenter Roeck wrote:
> Replace devm_add_action() with devm_add_action_or_reset(),
> and check its return value.
> 
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> ---
>  drivers/hwmon/lm90.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
> index 7b3eedf76c62..fa15f7238a28 100644
> --- a/drivers/hwmon/lm90.c
> +++ b/drivers/hwmon/lm90.c
> @@ -1551,9 +1551,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)
>  	if (config != data->config_orig) /* Only write if changed */
>  		i2c_smbus_write_byte_data(client, LM90_REG_W_CONFIG1, config);
>  
> -	devm_add_action(&client->dev, lm90_restore_conf, data);
> -
> -	return 0;
> +	return devm_add_action_or_reset(&client->dev, lm90_restore_conf, data);
>  }
>  
>  static bool lm90_is_tripped(struct i2c_client *client, u16 *status)
> @@ -1640,7 +1638,9 @@ static int lm90_probe(struct i2c_client *client,
>  		return err;
>  	}
>  
> -	devm_add_action(dev, lm90_regulator_disable, regulator);
> +	err = devm_add_action_or_reset(dev, lm90_regulator_disable, regulator);
> +	if (err)
> +		return err;
>  
>  	data = devm_kzalloc(dev, sizeof(struct lm90_data), GFP_KERNEL);
>  	if (!data)
> @@ -1696,7 +1696,9 @@ static int lm90_probe(struct i2c_client *client,
>  		err = device_create_file(dev, &dev_attr_pec);
>  		if (err)
>  			return err;
> -		devm_add_action(dev, lm90_remove_pec, dev);
> +		err = devm_add_action_or_reset(dev, lm90_remove_pec, dev);
> +		if (err)
> +			return err;
>  	}
>  
>  	hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,

I'm not yet familiar with that API but it looks like the right thing to
do.

Reviewed-by: Jean Delvare <jdelvare@suse.de>

-- 
Jean Delvare
SUSE L3 Support

[PATCH] hwmon: (tmp102) Improve error handling

[Guenter Roeck]

Use devm_add_action_or_reset() instead of devm_add_action(), and
check its return code.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/tmp102.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/tmp102.c b/drivers/hwmon/tmp102.c
index a942a2574a4d..8479ac5eb853 100644
--- a/drivers/hwmon/tmp102.c
+++ b/drivers/hwmon/tmp102.c
@@ -227,7 +227,9 @@ static int tmp102_probe(struct i2c_client *client,
 
 	tmp102->config_orig = regval;
 
-	devm_add_action(dev, tmp102_restore_config, tmp102);
+	err = devm_add_action_or_reset(dev, tmp102_restore_config, tmp102);
+	if (err)
+		return err;
 
 	regval &= ~TMP102_CONFIG_CLEAR;
 	regval |= TMP102_CONFIG_SET;
-- 
2.5.0