diff options
| author | Jean Delvare <khali@linux-fr.org> | 2005-08-25 18:43:37 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-08-26 16:31:46 -0700 |
| commit | 3fd1bb9baa394856b112e5edbfd3893d92dd1149 (patch) | |
| tree | a193631316e25b1d697f232eeeb5afd6ddcc8fb6 /drivers/hwmon | |
| parent | 566ecb9b258ec4da3c7e1c6ca6fca8a5bb0c8eba (diff) | |
| download | op-kernel-dev-3fd1bb9baa394856b112e5edbfd3893d92dd1149.zip op-kernel-dev-3fd1bb9baa394856b112e5edbfd3893d92dd1149.tar.gz | |
[PATCH] hwmon: Off-by-one error in fscpos driver
Coverity uncovered an off-by-one error in the fscpos driver, in function
set_temp_reset(). Writing to the temp3_reset sysfs file will lead to an
array overrun, in turn causing an I2C write to a random register of the
FSC Poseidon chip. Additionally, writing to temp1_reset and temp2_reset
will not work as expected. The fix is straightforward.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/hwmon')
| -rw-r--r-- | drivers/hwmon/fscpos.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hwmon/fscpos.c b/drivers/hwmon/fscpos.c index 270015b..301ae98 100644 --- a/drivers/hwmon/fscpos.c +++ b/drivers/hwmon/fscpos.c @@ -167,7 +167,7 @@ static ssize_t set_temp_reset(struct i2c_client *client, struct fscpos_data "experience to the module author.\n"); /* Supported value: 2 (clears the status) */ - fscpos_write_value(client, FSCPOS_REG_TEMP_STATE[nr], 2); + fscpos_write_value(client, FSCPOS_REG_TEMP_STATE[nr - 1], 2); return count; } |
