[PATCH v2] hwmon: (lm80) fix a missing check of the status of SMBus read

[PATCH v2] hwmon: (lm80) fix a missing check of the status of SMBus read

[Kangjie Lu]

If lm80_read_value() fails, it returns a negative number instead of the
correct read data. Therefore, we should avoid using the data if it
fails.

The fix checks if lm80_read_value() fails, and if so, returns with the
error number.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
---
 drivers/hwmon/lm80.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index 08e3945a6fbf..d91333557f04 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -360,6 +360,7 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
 	struct i2c_client *client = data->client;
 	unsigned long min, val;
 	u8 reg;
+	int rv;
 	int err = kstrtoul(buf, 10, &val);
 	if (err < 0)
 		return err;
@@ -390,8 +391,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
 		return -EINVAL;
 	}
 
-	reg = (lm80_read_value(client, LM80_REG_FANDIV) &
-	       ~(3 << (2 * (nr + 1)))) | (data->fan_div[nr] << (2 * (nr + 1)));
+	rv = lm80_read_value(client, LM80_REG_FANDIV);
+	if (rv < 0)
+		return rv;
+	reg = (rv & ~(3 << (2 * (nr + 1))))
+	    | (data->fan_div[nr] << (2 * (nr + 1)));
 	lm80_write_value(client, LM80_REG_FANDIV, reg);
 
 	/* Restore fan_min */
-- 
2.17.1

Re: [PATCH v2] hwmon: (lm80) fix a missing check of the status of SMBus read

[Guenter Roeck]

On Fri, Dec 21, 2018 at 01:01:33PM -0600, Kangjie Lu wrote:
> If lm80_read_value() fails, it returns a negative number instead of the
> correct read data. Therefore, we should avoid using the data if it
> fails.
> 
> The fix checks if lm80_read_value() fails, and if so, returns with the
> error number.
> 
> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
> ---
[ change log goes here ]

>  drivers/hwmon/lm80.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
> index 08e3945a6fbf..d91333557f04 100644
> --- a/drivers/hwmon/lm80.c
> +++ b/drivers/hwmon/lm80.c
> @@ -360,6 +360,7 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
>  	struct i2c_client *client = data->client;
>  	unsigned long min, val;
>  	u8 reg;
> +	int rv;
>  	int err = kstrtoul(buf, 10, &val);
>  	if (err < 0)
>  		return err;

Now we have 'rv' and 'err'.

My earlier comments didn't mean to suggest that we should now have two
different variables to handle errors.

Never mind, I'll fix it all up myself. No need to resend.

Guenter

> @@ -390,8 +391,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
>  		return -EINVAL;
>  	}
>  
> -	reg = (lm80_read_value(client, LM80_REG_FANDIV) &
> -	       ~(3 << (2 * (nr + 1)))) | (data->fan_div[nr] << (2 * (nr + 1)));
> +	rv = lm80_read_value(client, LM80_REG_FANDIV);
> +	if (rv < 0)
> +		return rv;
> +	reg = (rv & ~(3 << (2 * (nr + 1))))
> +	    | (data->fan_div[nr] << (2 * (nr + 1)));
>  	lm80_write_value(client, LM80_REG_FANDIV, reg);
>  
>  	/* Restore fan_min */