* drivers/hwmon/lm93.c: array overruns
@ 2007-07-23 0:54 Adrian Bunk
2007-07-23 7:36 ` Hans-Jürgen Koch
0 siblings, 1 reply; 6+ messages in thread
From: Adrian Bunk @ 2007-07-23 0:54 UTC (permalink / raw)
To: Hans-Jürgen Koch, Mark M. Hoffman; +Cc: lm-sensors, linux-kernel
The Coverity checker spotted the following array overruns
in drivers/hwmon/lm93.c:
<-- snip -->
...
struct lm93_data {
...
struct {
u8 min;
u8 max;
} temp_lim[3];
...
};
...
static void lm93_update_client_common(struct lm93_data *data,
struct i2c_client *client)
{
...
for (i = 0; i < 4; i++) {
data->temp_lim[i].min =
lm93_read_byte(client, LM93_REG_TEMP_MIN(i));
data->temp_lim[i].max =
lm93_read_byte(client, LM93_REG_TEMP_MAX(i));
}
...
<-- snip -->
cu
Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
"Only a promise," Lao Er said.
Pearl S. Buck - Dragon Seed
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: drivers/hwmon/lm93.c: array overruns
2007-07-23 0:54 drivers/hwmon/lm93.c: array overruns Adrian Bunk
@ 2007-07-23 7:36 ` Hans-Jürgen Koch
2007-07-24 8:10 ` [lm-sensors] " Jean Delvare
2007-07-24 13:00 ` Mark M. Hoffman
0 siblings, 2 replies; 6+ messages in thread
From: Hans-Jürgen Koch @ 2007-07-23 7:36 UTC (permalink / raw)
To: Adrian Bunk; +Cc: Mark M. Hoffman, lm-sensors, linux-kernel
Am Montag 23 Juli 2007 02:54 schrieb Adrian Bunk:
> The Coverity checker spotted the following array overruns
> in drivers/hwmon/lm93.c:
>
> <-- snip -->
>
> ...
> struct lm93_data {
> ...
> struct {
> u8 min;
> u8 max;
> } temp_lim[3];
> ...
> };
> ...
> static void lm93_update_client_common(struct lm93_data *data,
> struct i2c_client *client)
> {
> ...
> for (i = 0; i < 4; i++) {
> data->temp_lim[i].min =
> lm93_read_byte(client, LM93_REG_TEMP_MIN(i));
> data->temp_lim[i].max =
> lm93_read_byte(client, LM93_REG_TEMP_MAX(i));
> }
> ...
>
> <-- snip -->
This patch should fix it. Thanks a lot, Adrian!
----
This fixes an array overflow bug. We have 4 pairs of min/max temperature
limits, not 3.
Signed-off-by: Hans J. Koch <hjk@linutronix.de>
--
Index: linux-2.6.23-rc/drivers/hwmon/lm93.c
===================================================================
--- linux-2.6.23-rc.orig/drivers/hwmon/lm93.c 2007-07-23 09:22:56.000000000 +0200
+++ linux-2.6.23-rc/drivers/hwmon/lm93.c 2007-07-23 09:29:37.000000000 +0200
@@ -234,7 +234,7 @@
struct {
u8 min;
u8 max;
- } temp_lim[3];
+ } temp_lim[4];
/* vin1 - vin16: low and high limits */
struct {
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [lm-sensors] drivers/hwmon/lm93.c: array overruns
2007-07-23 7:36 ` Hans-Jürgen Koch
@ 2007-07-24 8:10 ` Jean Delvare
2007-07-24 8:26 ` Hans-Jürgen Koch
2007-07-24 13:00 ` Mark M. Hoffman
1 sibling, 1 reply; 6+ messages in thread
From: Jean Delvare @ 2007-07-24 8:10 UTC (permalink / raw)
To: Hans-Jürgen Koch
Cc: Adrian Bunk, Mark M. Hoffman, linux-kernel, lm-sensors
Hi Hans,
On Mon, 23 Jul 2007 09:36:57 +0200, Hans-Jürgen Koch wrote:
> Am Montag 23 Juli 2007 02:54 schrieb Adrian Bunk:
> > The Coverity checker spotted the following array overruns
> > in drivers/hwmon/lm93.c:
> >
> > <-- snip -->
> >
> > ...
> > struct lm93_data {
> > ...
> > struct {
> > u8 min;
> > u8 max;
> > } temp_lim[3];
> > ...
> > };
> > ...
> > static void lm93_update_client_common(struct lm93_data *data,
> > struct i2c_client *client)
> > {
> > ...
> > for (i = 0; i < 4; i++) {
> > data->temp_lim[i].min =
> > lm93_read_byte(client, LM93_REG_TEMP_MIN(i));
> > data->temp_lim[i].max =
> > lm93_read_byte(client, LM93_REG_TEMP_MAX(i));
> > }
> > ...
> >
> > <-- snip -->
>
> This patch should fix it. Thanks a lot, Adrian!
>
> ----
> This fixes an array overflow bug. We have 4 pairs of min/max temperature
> limits, not 3.
>
> Signed-off-by: Hans J. Koch <hjk@linutronix.de>
>
> --
> Index: linux-2.6.23-rc/drivers/hwmon/lm93.c
> ===================================================================
> --- linux-2.6.23-rc.orig/drivers/hwmon/lm93.c 2007-07-23 09:22:56.000000000 +0200
> +++ linux-2.6.23-rc/drivers/hwmon/lm93.c 2007-07-23 09:29:37.000000000 +0200
> @@ -234,7 +234,7 @@
> struct {
> u8 min;
> u8 max;
> - } temp_lim[3];
> + } temp_lim[4];
>
> /* vin1 - vin16: low and high limits */
> struct {
This will do as a quick fix, so:
Acked-by: Jean Delvare <khali@linux-fr.org>
However, I see that temp4 (which isn't a real temperature channel) is
not exposed in sysfs. Reading and storing register values you never use
doesn't seem particularly interesting, so something needs to be done
here: either drop support for temp4 entirely, or expose the temp4
values in sysfs.
--
Jean Delvare
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [lm-sensors] drivers/hwmon/lm93.c: array overruns
2007-07-24 8:10 ` [lm-sensors] " Jean Delvare
@ 2007-07-24 8:26 ` Hans-Jürgen Koch
2007-07-24 12:00 ` Jean Delvare
0 siblings, 1 reply; 6+ messages in thread
From: Hans-Jürgen Koch @ 2007-07-24 8:26 UTC (permalink / raw)
To: Jean Delvare; +Cc: Adrian Bunk, Mark M. Hoffman, linux-kernel, lm-sensors
Am Dienstag 24 Juli 2007 10:10 schrieb Jean Delvare:
> Hi Hans,
>
> On Mon, 23 Jul 2007 09:36:57 +0200, Hans-Jürgen Koch wrote:
> > Am Montag 23 Juli 2007 02:54 schrieb Adrian Bunk:
> > > The Coverity checker spotted the following array overruns
> > > in drivers/hwmon/lm93.c:
> > >
> > > <-- snip -->
> > >
> > > ...
> > > struct lm93_data {
> > > ...
> > > struct {
> > > u8 min;
> > > u8 max;
> > > } temp_lim[3];
> > > ...
> > > };
> > > ...
> > > static void lm93_update_client_common(struct lm93_data *data,
> > > struct i2c_client *client)
> > > {
> > > ...
> > > for (i = 0; i < 4; i++) {
> > > data->temp_lim[i].min =
> > > lm93_read_byte(client, LM93_REG_TEMP_MIN(i));
> > > data->temp_lim[i].max =
> > > lm93_read_byte(client, LM93_REG_TEMP_MAX(i));
> > > }
> > > ...
> > >
> > > <-- snip -->
> >
> > This patch should fix it. Thanks a lot, Adrian!
> >
> > ----
> > This fixes an array overflow bug. We have 4 pairs of min/max temperature
> > limits, not 3.
> >
> > Signed-off-by: Hans J. Koch <hjk@linutronix.de>
> >
> > --
> > Index: linux-2.6.23-rc/drivers/hwmon/lm93.c
> > ===================================================================
> > --- linux-2.6.23-rc.orig/drivers/hwmon/lm93.c 2007-07-23 09:22:56.000000000 +0200
> > +++ linux-2.6.23-rc/drivers/hwmon/lm93.c 2007-07-23 09:29:37.000000000 +0200
> > @@ -234,7 +234,7 @@
> > struct {
> > u8 min;
> > u8 max;
> > - } temp_lim[3];
> > + } temp_lim[4];
> >
> > /* vin1 - vin16: low and high limits */
> > struct {
>
> This will do as a quick fix, so:
>
> Acked-by: Jean Delvare <khali@linux-fr.org>
>
> However, I see that temp4 (which isn't a real temperature channel) is
> not exposed in sysfs. Reading and storing register values you never use
> doesn't seem particularly interesting, so something needs to be done
> here: either drop support for temp4 entirely, or expose the temp4
> values in sysfs.
I've got that on my TODO list. I'll soon work on that driver again. I'm still
waiting for that #§$?& NDA-covered datasheet of the LM94. As soon as I've got
that, I need to review all these values anyway because there might be subtle
differences between LM93 and LM94.
For the moment, I'd like to postpone the decision about what to do with temp4.
Thanks anyway for pointing this out.
Hans
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [lm-sensors] drivers/hwmon/lm93.c: array overruns
2007-07-24 8:26 ` Hans-Jürgen Koch
@ 2007-07-24 12:00 ` Jean Delvare
0 siblings, 0 replies; 6+ messages in thread
From: Jean Delvare @ 2007-07-24 12:00 UTC (permalink / raw)
To: Hans-Jürgen Koch
Cc: Adrian Bunk, Mark M. Hoffman, linux-kernel, lm-sensors
Hi Hans,
On Tue, 24 Jul 2007 10:26:46 +0200, Hans-Jürgen Koch wrote:
> Am Dienstag 24 Juli 2007 10:10 schrieb Jean Delvare:
> > However, I see that temp4 (which isn't a real temperature channel) is
> > not exposed in sysfs. Reading and storing register values you never use
> > doesn't seem particularly interesting, so something needs to be done
> > here: either drop support for temp4 entirely, or expose the temp4
> > values in sysfs.
>
> I've got that on my TODO list. I'll soon work on that driver again. I'm still
> waiting for that #§$?& NDA-covered datasheet of the LM94. As soon as I've got
> that, I need to review all these values anyway because there might be subtle
> differences between LM93 and LM94.
> For the moment, I'd like to postpone the decision about what to do with temp4.
Sure, no problem.
--
Jean Delvare
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: drivers/hwmon/lm93.c: array overruns
2007-07-23 7:36 ` Hans-Jürgen Koch
2007-07-24 8:10 ` [lm-sensors] " Jean Delvare
@ 2007-07-24 13:00 ` Mark M. Hoffman
1 sibling, 0 replies; 6+ messages in thread
From: Mark M. Hoffman @ 2007-07-24 13:00 UTC (permalink / raw)
To: Hans-Jürgen Koch; +Cc: Adrian Bunk, lm-sensors, linux-kernel
* Hans-Jürgen Koch <hjk@linutronix.de> [2007-07-23 09:36:57 +0200]:
> Am Montag 23 Juli 2007 02:54 schrieb Adrian Bunk:
> > The Coverity checker spotted the following array overruns
> > in drivers/hwmon/lm93.c:
> >
> > <-- snip -->
> >
> > ...
> > struct lm93_data {
> > ...
> > struct {
> > u8 min;
> > u8 max;
> > } temp_lim[3];
> > ...
> > };
> > ...
> > static void lm93_update_client_common(struct lm93_data *data,
> > struct i2c_client *client)
> > {
> > ...
> > for (i = 0; i < 4; i++) {
> > data->temp_lim[i].min =
> > lm93_read_byte(client, LM93_REG_TEMP_MIN(i));
> > data->temp_lim[i].max =
> > lm93_read_byte(client, LM93_REG_TEMP_MAX(i));
> > }
> > ...
> >
> > <-- snip -->
>
> This patch should fix it. Thanks a lot, Adrian!
>
> ----
> This fixes an array overflow bug. We have 4 pairs of min/max temperature
> limits, not 3.
>
> Signed-off-by: Hans J. Koch <hjk@linutronix.de>
>
> --
> Index: linux-2.6.23-rc/drivers/hwmon/lm93.c
> ===================================================================
> --- linux-2.6.23-rc.orig/drivers/hwmon/lm93.c 2007-07-23 09:22:56.000000000 +0200
> +++ linux-2.6.23-rc/drivers/hwmon/lm93.c 2007-07-23 09:29:37.000000000 +0200
> @@ -234,7 +234,7 @@
> struct {
> u8 min;
> u8 max;
> - } temp_lim[3];
> + } temp_lim[4];
>
> /* vin1 - vin16: low and high limits */
> struct {
>
>
Applied to testing, thanks.
--
Mark M. Hoffman
mhoffman@lightlink.com
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2007-07-24 13:07 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-07-23 0:54 drivers/hwmon/lm93.c: array overruns Adrian Bunk
2007-07-23 7:36 ` Hans-Jürgen Koch
2007-07-24 8:10 ` [lm-sensors] " Jean Delvare
2007-07-24 8:26 ` Hans-Jürgen Koch
2007-07-24 12:00 ` Jean Delvare
2007-07-24 13:00 ` Mark M. Hoffman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox