• Kees Cook's avatar
    hwmon: (nct6775-platform) Explicitly initialize nct6775_sio_names indexes · efe86092
    Kees Cook authored
    Changing the "kinds" enum start value to be 1-indexed instead of
    0-indexed caused look-ups in nct6775_sio_namesp[] to be misaligned or
    off the end. Coverity reported:
    
    *** CID 1571052:  Memory - illegal accesses  (OVERRUN)
    drivers/hwmon/nct6775-platform.c:1075 in nct6775_find()
    1069                sio_data->kind == nct6793 || sio_data->kind == nct6795 ||
    1070                sio_data->kind == nct6796 || sio_data->kind == nct6797 ||
    1071                sio_data->kind == nct6798 || sio_data->kind == nct6799)
    1072                    nct6791_enable_io_mapping(sio_data);
    1073
    1074            sio_data->sio_exit(sio_data);
    vvv     CID 1571052:  Memory - illegal accesses  (OVERRUN)
    vvv     Overrunning array "nct6775_sio_names" of 13 8-byte elements at element index 13 (byte offset 111) using index "sio_data->kind" (which evaluates to 13).
    1075            pr_info("Found %s or compatible chip at %#x:%#x\n",
    1076                    nct6775_sio_names[sio_data->kind], sioaddr, addr);
    1077
    1078            return addr;
    1079     }
    1080
    
    Initialize the string list with explicit indexes.
    
    Cc: Guenter Roeck <linux@roeck-us.net>
    Cc: Rob Herring <robh@kernel.org>
    Cc: Jean Delvare <jdelvare@suse.com>
    Cc: linux-hwmon@vger.kernel.org
    Fixes: 10a0575e ("hwmon: nct6775-i2c: Use i2c_get_match_data()")
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/r/20231116140144.work.027-kees@kernel.orgSigned-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
    efe86092
nct6775-platform.c 40.8 KB