hwmon: (adt7470) Fix PWM auto temp state array and bounds check

In pwm_auto_temp_store(), the parsed user input was missing bounds
checks, allowing values > 0xF to overflow into the adjacent channel's
bits. Furthermore, the value was being incorrectly written to the
pwm_automatic state array instead of pwm_auto_temp.

Fix this by rejecting values > 0xF with -EINVAL, and assigning the
value to the correct array only after a successful I2C write.

Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260727034932.0B7C41F000E9@smtp.kernel.org/#t
Fixes: 6f9703d0be16 ("hwmon: add support for adt7470")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Link: https://lore.kernel.org/r/20260727-adt7470_fixes-v2-8-598e38a46ba6@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 772d2a409bb5c6a4f8cfb80b661a7cc9234cbb4a..c45b984c02e6b93c8cbff5d3772fe54d624ab68f 100644 (file)
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -1049,8 +1049,10 @@ static ssize_t pwm_auto_temp_store(struct device *dev,
        if (temp < 0)
                return temp;
 
+       if (temp > 0xF)
+               return -EINVAL;
+
        mutex_lock(&data->lock);
-       data->pwm_automatic[attr->index] = temp;
 
        if (!(attr->index % 2)) {
                mask = 0xF0;
@@ -1061,6 +1063,9 @@ static ssize_t pwm_auto_temp_store(struct device *dev,
        }
 
        err = regmap_update_bits(data->regmap, pwm_auto_reg, mask, val);
+       if (!err)
+               data->pwm_auto_temp[attr->index] = temp;
+
        mutex_unlock(&data->lock);
 
        return err < 0 ? err : count;