diff options
| author | Luiz Angelo Daros de Luca <luizluca@gmail.com> | 2026-07-27 21:22:24 -0300 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2026-07-27 17:58:39 -0700 |
| commit | 92413f439d1ec5e55b73ede8d66a7b971cbd1ced (patch) | |
| tree | b7bf9ff481f7f5dff37e4b12e3d20a3d414e0756 | |
| parent | 1b46fe9dc8f8de59310f37e6c5e5c0e05ded46c3 (diff) | |
| download | linux-next-92413f439d1ec5e55b73ede8d66a7b971cbd1ced.tar.gz linux-next-92413f439d1ec5e55b73ede8d66a7b971cbd1ced.zip | |
hwmon: (adt7470) Fix PWM auto temp state array and bounds check
In pwm_auto_temp_store(), the parsed user input was missing bounds
checks, allowing values > 0xF to overflow into the adjacent channel's
bits. Furthermore, the value was being incorrectly written to the
pwm_automatic state array instead of pwm_auto_temp.
Fix this by rejecting values > 0xF with -EINVAL, and assigning the
value to the correct array only after a successful I2C write.
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260727034932.0B7C41F000E9@smtp.kernel.org/#t
Fixes: 6f9703d0be16 ("hwmon: add support for adt7470")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Link: https://lore.kernel.org/r/20260727-adt7470_fixes-v2-8-598e38a46ba6@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
| -rw-r--r-- | drivers/hwmon/adt7470.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c index 772d2a409bb5..c45b984c02e6 100644 --- a/drivers/hwmon/adt7470.c +++ b/drivers/hwmon/adt7470.c @@ -1049,8 +1049,10 @@ static ssize_t pwm_auto_temp_store(struct device *dev, if (temp < 0) return temp; + if (temp > 0xF) + return -EINVAL; + mutex_lock(&data->lock); - data->pwm_automatic[attr->index] = temp; if (!(attr->index % 2)) { mask = 0xF0; @@ -1061,6 +1063,9 @@ static ssize_t pwm_auto_temp_store(struct device *dev, } err = regmap_update_bits(data->regmap, pwm_auto_reg, mask, val); + if (!err) + data->pwm_auto_temp[attr->index] = temp; + mutex_unlock(&data->lock); return err < 0 ? err : count; |