| Message ID | 1528902636-9810-1-git-send-email-linux@roeck-us.net (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
Dear Guenter, Am 13.06.2018 um 17:10 schrieb Guenter Roeck: > Commit cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label > handling") changed a loop limit from "data->temp_label_num - 1" to "32", > as part of moving from a string array to a bit mask. This results in the > following error, reported by UBSAN. > > UBSAN: Undefined behaviour in drivers/hwmon/nct6775.c:4179:27 > shift exponent 32 is too large for 32-bit type 'long unsigned int' > > Similar to the original loop, the limit has to be one less than the > number of bits. > > Fixes: cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label handling") > Reported-by: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de> > Cc: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de> > Signed-off-by: Guenter Roeck <linux@roeck-us.net> > --- > drivers/hwmon/nct6775.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c > index aebce560bfaf..b14eb73bc3c9 100644 > --- a/drivers/hwmon/nct6775.c > +++ b/drivers/hwmon/nct6775.c > @@ -4175,7 +4175,7 @@ static int nct6775_probe(struct platform_device *pdev) > * The temperature is already monitored if the respective bit in <mask> > * is set. > */ > - for (i = 0; i < 32; i++) { > + for (i = 0; i < 31; i++) { > if (!(data->temp_mask & BIT(i + 1))) > continue; > if (!reg_temp_alternate[i]) Thank you for the patch. I tested that the UBSAN message is gone, and that the module loads. Tested-by: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de> Kind regards Paul -- To unsubscribe from this list: send the line "unsubscribe linux-hwmon" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, Jun 13, 2018 at 10:06:16PM +0200, Paul Menzel wrote: > Dear Guenter, > > > Am 13.06.2018 um 17:10 schrieb Guenter Roeck: > >Commit cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label > >handling") changed a loop limit from "data->temp_label_num - 1" to "32", > >as part of moving from a string array to a bit mask. This results in the > >following error, reported by UBSAN. > > > >UBSAN: Undefined behaviour in drivers/hwmon/nct6775.c:4179:27 > >shift exponent 32 is too large for 32-bit type 'long unsigned int' > > > >Similar to the original loop, the limit has to be one less than the > >number of bits. > > > >Fixes: cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label handling") > >Reported-by: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de> > >Cc: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de> > >Signed-off-by: Guenter Roeck <linux@roeck-us.net> > >--- > > drivers/hwmon/nct6775.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > >diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c > >index aebce560bfaf..b14eb73bc3c9 100644 > >--- a/drivers/hwmon/nct6775.c > >+++ b/drivers/hwmon/nct6775.c > >@@ -4175,7 +4175,7 @@ static int nct6775_probe(struct platform_device *pdev) > > * The temperature is already monitored if the respective bit in <mask> > > * is set. > > */ > >- for (i = 0; i < 32; i++) { > >+ for (i = 0; i < 31; i++) { > > if (!(data->temp_mask & BIT(i + 1))) > > continue; > > if (!reg_temp_alternate[i]) > > Thank you for the patch. I tested that the UBSAN message is gone, and that > the module loads. > > Tested-by: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de> > Thanks! Guenter -- To unsubscribe from this list: send the line "unsubscribe linux-hwmon" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c index aebce560bfaf..b14eb73bc3c9 100644 --- a/drivers/hwmon/nct6775.c +++ b/drivers/hwmon/nct6775.c @@ -4175,7 +4175,7 @@ static int nct6775_probe(struct platform_device *pdev) * The temperature is already monitored if the respective bit in <mask> * is set. */ - for (i = 0; i < 32; i++) { + for (i = 0; i < 31; i++) { if (!(data->temp_mask & BIT(i + 1))) continue; if (!reg_temp_alternate[i])
Commit cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label handling") changed a loop limit from "data->temp_label_num - 1" to "32", as part of moving from a string array to a bit mask. This results in the following error, reported by UBSAN. UBSAN: Undefined behaviour in drivers/hwmon/nct6775.c:4179:27 shift exponent 32 is too large for 32-bit type 'long unsigned int' Similar to the original loop, the limit has to be one less than the number of bits. Fixes: cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label handling") Reported-by: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de> Cc: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de> Signed-off-by: Guenter Roeck <linux@roeck-us.net> --- drivers/hwmon/nct6775.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)