Linux-Hwmon Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH AUTOSEL 5.7 15/40] hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
       [not found] <20200720213715.406997-1-sashal@kernel.org>
@ 2020-07-20 21:36 ` Sasha Levin
  2020-07-20 21:37 ` [PATCH AUTOSEL 5.7 25/40] hwmon: (adm1275) Make sure we are reading enough data for different chips Sasha Levin
                   ` (2 subsequent siblings)
  3 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2020-07-20 21:36 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Evgeny Novikov, Guenter Roeck, Sasha Levin, linux-hwmon,
	linux-arm-kernel, linux-aspeed

From: Evgeny Novikov <novikov@ispras.ru>

[ Upstream commit bc4071aafcf4d0535ee423b69167696d6c03207d ]

aspeed_create_fan() reads a pwm_port value using of_property_read_u32().
If pwm_port will be more than ARRAY_SIZE(pwm_port_params), there will be
a buffer overflow in
aspeed_create_pwm_port()->aspeed_set_pwm_port_enable(). The patch fixes
the potential buffer overflow.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Link: https://lore.kernel.org/r/20200703111518.9644-1-novikov@ispras.ru
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/aspeed-pwm-tacho.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
index 33fb54845bf6d..3d8239fd66ed6 100644
--- a/drivers/hwmon/aspeed-pwm-tacho.c
+++ b/drivers/hwmon/aspeed-pwm-tacho.c
@@ -851,6 +851,8 @@ static int aspeed_create_fan(struct device *dev,
 	ret = of_property_read_u32(child, "reg", &pwm_port);
 	if (ret)
 		return ret;
+	if (pwm_port >= ARRAY_SIZE(pwm_port_params))
+		return -EINVAL;
 	aspeed_create_pwm_port(priv, (u8)pwm_port);
 
 	ret = of_property_count_u8_elems(child, "cooling-levels");
-- 
2.25.1


^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH AUTOSEL 5.7 25/40] hwmon: (adm1275) Make sure we are reading enough data for different chips
       [not found] <20200720213715.406997-1-sashal@kernel.org>
  2020-07-20 21:36 ` [PATCH AUTOSEL 5.7 15/40] hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow Sasha Levin
@ 2020-07-20 21:37 ` Sasha Levin
  2020-07-20 21:37 ` [PATCH AUTOSEL 5.7 28/40] hwmon: (nct6775) Accept PECI Calibration as temperature source for NCT6798D Sasha Levin
  2020-07-20 21:37 ` [PATCH AUTOSEL 5.7 31/40] hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe() Sasha Levin
  3 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2020-07-20 21:37 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Chu Lin, Guenter Roeck, Sasha Levin, linux-hwmon

From: Chu Lin <linchuyuan@google.com>

[ Upstream commit 6d1d41c075a1a54ba03370e268171fec20e06563 ]

Issue:
When PEC is enabled, binding adm1272 to the adm1275 would
fail due to PEC error. See below:
adm1275: probe of xxxx failed with error -74

Diagnosis:
Per the datasheet of adm1272, adm1278, adm1293 and amd1294,
PMON_CONFIG (0xd4) is 16bits wide. On the other hand,
PMON_CONFIG (0xd4) for adm1275 is 8bits wide. The driver should not
assume everything is 8bits wide and read only 8bits from it.

Solution:
If it is adm1272, adm1278, adm1293 and adm1294, use i2c_read_word.
Else, use i2c_read_byte

Testing:
Binding adm1272 to the driver.
The change is only tested on adm1272.

Signed-off-by: Chu Lin <linchuyuan@google.com>
Link: https://lore.kernel.org/r/20200709040612.3977094-1-linchuyuan@google.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pmbus/adm1275.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
index e25f541227dae..19317575d1c6a 100644
--- a/drivers/hwmon/pmbus/adm1275.c
+++ b/drivers/hwmon/pmbus/adm1275.c
@@ -465,6 +465,7 @@ MODULE_DEVICE_TABLE(i2c, adm1275_id);
 static int adm1275_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id)
 {
+	s32 (*config_read_fn)(const struct i2c_client *client, u8 reg);
 	u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1];
 	int config, device_config;
 	int ret;
@@ -510,11 +511,16 @@ static int adm1275_probe(struct i2c_client *client,
 			   "Device mismatch: Configured %s, detected %s\n",
 			   id->name, mid->name);
 
-	config = i2c_smbus_read_byte_data(client, ADM1275_PMON_CONFIG);
+	if (mid->driver_data == adm1272 || mid->driver_data == adm1278 ||
+	    mid->driver_data == adm1293 || mid->driver_data == adm1294)
+		config_read_fn = i2c_smbus_read_word_data;
+	else
+		config_read_fn = i2c_smbus_read_byte_data;
+	config = config_read_fn(client, ADM1275_PMON_CONFIG);
 	if (config < 0)
 		return config;
 
-	device_config = i2c_smbus_read_byte_data(client, ADM1275_DEVICE_CONFIG);
+	device_config = config_read_fn(client, ADM1275_DEVICE_CONFIG);
 	if (device_config < 0)
 		return device_config;
 
-- 
2.25.1


^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH AUTOSEL 5.7 28/40] hwmon: (nct6775) Accept PECI Calibration as temperature source for NCT6798D
       [not found] <20200720213715.406997-1-sashal@kernel.org>
  2020-07-20 21:36 ` [PATCH AUTOSEL 5.7 15/40] hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow Sasha Levin
  2020-07-20 21:37 ` [PATCH AUTOSEL 5.7 25/40] hwmon: (adm1275) Make sure we are reading enough data for different chips Sasha Levin
@ 2020-07-20 21:37 ` Sasha Levin
  2020-07-20 21:37 ` [PATCH AUTOSEL 5.7 31/40] hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe() Sasha Levin
  3 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2020-07-20 21:37 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Guenter Roeck, Stefan Dietrich, Sasha Levin, linux-hwmon

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 8a03746c8baf82e1616f05a1a716d34378dcf780 ]

Stefan Dietrich reports invalid temperature source messages on Asus Formula
XII Z490.

nct6775 nct6775.656: Invalid temperature source 28 at index 0,
		source register 0x100, temp register 0x73

Debugging suggests that temperature source 28 reports the CPU temperature.
Let's assume that temperature sources 28 and 29 reflect "PECI Agent {0,1}
Calibration", similar to other chips of the series.

Reported-by: Stefan Dietrich <roots@gmx.de>
Cc: Stefan Dietrich <roots@gmx.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/nct6775.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index 7efa6bfef0609..ba9b96973e808 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -786,13 +786,13 @@ static const char *const nct6798_temp_label[] = {
 	"Agent1 Dimm1",
 	"BYTE_TEMP0",
 	"BYTE_TEMP1",
-	"",
-	"",
+	"PECI Agent 0 Calibration",	/* undocumented */
+	"PECI Agent 1 Calibration",	/* undocumented */
 	"",
 	"Virtual_TEMP"
 };
 
-#define NCT6798_TEMP_MASK	0x8fff0ffe
+#define NCT6798_TEMP_MASK	0xbfff0ffe
 #define NCT6798_VIRT_TEMP_MASK	0x80000c00
 
 /* NCT6102D/NCT6106D specific data */
-- 
2.25.1


^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH AUTOSEL 5.7 31/40] hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
       [not found] <20200720213715.406997-1-sashal@kernel.org>
                   ` (2 preceding siblings ...)
  2020-07-20 21:37 ` [PATCH AUTOSEL 5.7 28/40] hwmon: (nct6775) Accept PECI Calibration as temperature source for NCT6798D Sasha Levin
@ 2020-07-20 21:37 ` Sasha Levin
  3 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2020-07-20 21:37 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Cristian Marussi, Sudeep Holla, Guenter Roeck, Sasha Levin, linux-hwmon

From: Cristian Marussi <cristian.marussi@arm.com>

[ Upstream commit 3ce17cd2b94907f6d91b81b32848044b84c97606 ]

SMATCH detected a potential buffer overflow in the manipulation of
hwmon_attributes array inside the scmi_hwmon_probe function:

drivers/hwmon/scmi-hwmon.c:226
 scmi_hwmon_probe() error: buffer overflow 'hwmon_attributes' 6 <= 9

Fix it by statically declaring the size of the array as the maximum
possible as defined by hwmon_max define.

Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Link: https://lore.kernel.org/r/20200715121338.GA18761@e119603-lin.cambridge.arm.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/scmi-hwmon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c
index 286d3cfda7de8..d421e691318b3 100644
--- a/drivers/hwmon/scmi-hwmon.c
+++ b/drivers/hwmon/scmi-hwmon.c
@@ -147,7 +147,7 @@ static enum hwmon_sensor_types scmi_types[] = {
 	[ENERGY] = hwmon_energy,
 };
 
-static u32 hwmon_attributes[] = {
+static u32 hwmon_attributes[hwmon_max] = {
 	[hwmon_chip] = HWMON_C_REGISTER_TZ,
 	[hwmon_temp] = HWMON_T_INPUT | HWMON_T_LABEL,
 	[hwmon_in] = HWMON_I_INPUT | HWMON_I_LABEL,
-- 
2.25.1


^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <20200720213715.406997-1-sashal@kernel.org>
2020-07-20 21:36 ` [PATCH AUTOSEL 5.7 15/40] hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow Sasha Levin
2020-07-20 21:37 ` [PATCH AUTOSEL 5.7 25/40] hwmon: (adm1275) Make sure we are reading enough data for different chips Sasha Levin
2020-07-20 21:37 ` [PATCH AUTOSEL 5.7 28/40] hwmon: (nct6775) Accept PECI Calibration as temperature source for NCT6798D Sasha Levin
2020-07-20 21:37 ` [PATCH AUTOSEL 5.7 31/40] hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe() Sasha Levin

Linux-Hwmon Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-hwmon/0 linux-hwmon/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-hwmon linux-hwmon/ https://lore.kernel.org/linux-hwmon \
		linux-hwmon@vger.kernel.org
	public-inbox-index linux-hwmon

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-hwmon


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git