releases/2.6.14.3/hwmon-w83627hf-missing-in0-limit-check.patch

   1 From khali@linux-fr.org Mon Nov 14 13:55:35 2005
   2 Date: Mon, 14 Nov 2005 23:08:38 +0100
   3 From: Jean Delvare <khali@linux-fr.org>
   4 To: Greg KH <greg@kroah.com>
   5 Cc: Yuan Mu <Ymu@winbond.com.tw>
   6 Subject: [PATCH] hwmon: Fix missing boundary check when setting W83627THF in0 limits
   7 Message-Id: <20051114230838.37a9f2d8.khali@linux-fr.org>
   8 Content-Disposition: inline; filename=hwmon-w83627hf-missing-in0-limit-check.patch
   9
  10 From: Yuan Mu <Ymu@winbond.com.tw>
  11
  12 Add SENSORS_LIMIT in store VCore limit functions. This fixes a potential
  13 u8 overflow on out-of-range user input.
  14
  15 Signed-off-by: Jean Delvare <khali@linux-fr.org>
  16 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  17 Signed-off-by: Chris Wright <chrisw@osdl.org>
  18 ---
  19  drivers/hwmon/w83627hf.c |    8 ++++++--
  20  1 file changed, 6 insertions(+), 2 deletions(-)
  21
  22 --- linux-2.6.14.2.orig/drivers/hwmon/w83627hf.c
  23 +++ linux-2.6.14.2/drivers/hwmon/w83627hf.c
  24 @@ -454,7 +454,9 @@ static ssize_t store_regs_in_min0(struct
  25                 (w83627thf == data->type || w83637hf == data->type))
  26
  27                 /* use VRM9 calculation */
  28 -               data->in_min[0] = (u8)(((val * 100) - 70000 + 244) / 488);
  29 +               data->in_min[0] =
  30 +                       SENSORS_LIMIT(((val * 100) - 70000 + 244) / 488, 0,
  31 +                                       255);
  32         else
  33                 /* use VRM8 (standard) calculation */
  34                 data->in_min[0] = IN_TO_REG(val);
  35 @@ -479,7 +481,9 @@ static ssize_t store_regs_in_max0(struct
  36                 (w83627thf == data->type || w83637hf == data->type))
  37
  38                 /* use VRM9 calculation */
  39 -               data->in_max[0] = (u8)(((val * 100) - 70000 + 244) / 488);
  40 +               data->in_max[0] =
  41 +                       SENSORS_LIMIT(((val * 100) - 70000 + 244) / 488, 0,
  42 +                                       255);
  43         else
  44                 /* use VRM8 (standard) calculation */
  45                 data->in_max[0] = IN_TO_REG(val);