| Message ID | 20210920180921.16246-1-colin.king@canonical.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [next] hwmon: (mlxreg-fan): Fix out of bounds read on array fan->pwm | expand |
On Mon, Sep 20, 2021 at 07:09:21PM +0100, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > Array fan->pwm[] is MLXREG_FAN_MAX_PWM elements in size, however the > for-loop has a off-by-one error causing index i to be out of range > causing an out of bounds read on the array. Fix this by replacing > the <= operator with < in the for-loop. > > Addresses-Coverity: ("Out-of-bounds read") > Fixes: 35edbaab3bbf ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices") > Signed-off-by: Colin Ian King <colin.king@canonical.com> Applied. Thanks, Guenter > --- > drivers/hwmon/mlxreg-fan.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c > index 35228ed112d7..feab9ec6a6ca 100644 > --- a/drivers/hwmon/mlxreg-fan.c > +++ b/drivers/hwmon/mlxreg-fan.c > @@ -554,7 +554,7 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan) > { > int i, j; > > - for (i = 0; i <= MLXREG_FAN_MAX_PWM; i++) { > + for (i = 0; i < MLXREG_FAN_MAX_PWM; i++) { > struct mlxreg_fan_pwm *pwm = &fan->pwm[i]; > > if (!pwm->connected)
diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c index 35228ed112d7..feab9ec6a6ca 100644 --- a/drivers/hwmon/mlxreg-fan.c +++ b/drivers/hwmon/mlxreg-fan.c @@ -554,7 +554,7 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan) { int i, j; - for (i = 0; i <= MLXREG_FAN_MAX_PWM; i++) { + for (i = 0; i < MLXREG_FAN_MAX_PWM; i++) { struct mlxreg_fan_pwm *pwm = &fan->pwm[i]; if (!pwm->connected)