hwmon: (nct6775) Fix access to fan pulse registers
authorGuenter Roeck <linux@roeck-us.net>
Thu, 6 Sep 2018 16:47:51 +0000 (09:47 -0700)
committerGuenter Roeck <linux@roeck-us.net>
Fri, 7 Sep 2018 16:33:36 +0000 (09:33 -0700)
commitc793279c77035053e67937f5743c6ebfc303e7c5
treefd73514bf79e780e793b70e7bd5ae32b481f3d61
parente3f3d7ab00cd459d0f7a839758a4542f4d4b8ac8
hwmon: (nct6775) Fix access to fan pulse registers

Not all fans have a fan pulse register. This can result in reading
beyond the end of REG_FAN_PULSES and FAN_PULSE_SHIFT arrays,
and was reported by smatch as possible error.

1672          for (i = 0; i < ARRAY_SIZE(data->rpm); i++) {
                              ^^^^^^^^^^^^^^^^^^^^^^^^
      This is a 7 element array.
...
1685                  data->fan_pulses[i] =
1686                    (nct6775_read_value(data, data->REG_FAN_PULSES[i])
1687                          >> data->FAN_PULSE_SHIFT[i]) & 0x03;
                                 ^^^^^^^^^^^^^^^^^^^^^^^^
 FAN_PULSE_SHIFT is either 5 or 6
 elements.

To fix the problem, we have to ensure that all REG_FAN_PULSES and
FAN_PULSE_SHIFT have the appropriate length, and that REG_FAN_PULSES
is only read if the register actually exists.

Fixes: 6c009501ff200 ("hwmon: (nct6775) Add support for NCT6102D/6106D")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
drivers/hwmon/nct6775.c