Commit e214dd93 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hwmon-for-v6.1-rc8' of... 

Merge tag 'hwmon-for-v6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - Fix refcount leak and NULL pointer access in coretemp driver

 - Fix UAF in ibmpex driver

 - Add missing pci_disable_device() to i5500_temp driver

 - Fix calculation in ina3221 driver

 - Fix temperature scaling in ltc2947 driver

 - Check result of devm_kcalloc call in asus-ec-sensors driver

* tag 'hwmon-for-v6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (asus-ec-sensors) Add checks for devm_kcalloc
  hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
  hwmon: (coretemp) Check for null before removing sysfs attrs
  hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  hwmon: (i5500_temp) fix missing pci_disable_device()
  hwmon: (ina3221) Fix shunt sum critical calculation
  hwmon: (ltc2947) fix temperature scaling
parents 063c0e77 9bdc112b

drivers/hwmon/asus-ec-sensors.c

+2 −0
Original line number Diff line number Diff line
@@ -938,6 +938,8 @@ static int asus_ec_probe(struct platform_device *pdev) 
	ec_data->nr_sensors = hweight_long(ec_data->board_info->sensors);

	ec_data->sensors = devm_kcalloc(dev, ec_data->nr_sensors,

					sizeof(struct ec_sensor), GFP_KERNEL);

	if (!ec_data->sensors)

		return -ENOMEM;



	status = setup_lock_data(dev);

	if (status) {

drivers/hwmon/coretemp.c

+8 −1
Original line number Diff line number Diff line
@@ -242,10 +242,13 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev) 
	 */

	if (host_bridge && host_bridge->vendor == PCI_VENDOR_ID_INTEL) {

		for (i = 0; i < ARRAY_SIZE(tjmax_pci_table); i++) {

			if (host_bridge->device == tjmax_pci_table[i].device)

			if (host_bridge->device == tjmax_pci_table[i].device) {

				pci_dev_put(host_bridge);

				return tjmax_pci_table[i].tjmax;

			}

		}

	}

	pci_dev_put(host_bridge);



	for (i = 0; i < ARRAY_SIZE(tjmax_table); i++) {

		if (strstr(c->x86_model_id, tjmax_table[i].id))
@@ -533,6 +536,10 @@ static void coretemp_remove_core(struct platform_data *pdata, int indx) 
{

	struct temp_data *tdata = pdata->core_data[indx];



	/* if we errored on add then this is already gone */

	if (!tdata)

		return;



	/* Remove the sysfs attributes */

	sysfs_remove_group(&pdata->hwmon_dev->kobj, &tdata->attr_group);

drivers/hwmon/i5500_temp.c

+1 −1
Original line number Diff line number Diff line
@@ -117,7 +117,7 @@ static int i5500_temp_probe(struct pci_dev *pdev, 
	u32 tstimer;

	s8 tsfsc;



	err = pci_enable_device(pdev);

	err = pcim_enable_device(pdev);

	if (err) {

		dev_err(&pdev->dev, "Failed to enable device\n");

		return err;

drivers/hwmon/ibmpex.c

+1 −0
Original line number Diff line number Diff line
@@ -502,6 +502,7 @@ static void ibmpex_register_bmc(int iface, struct device *dev) 
	return;



out_register:

	list_del(&data->list);

	hwmon_device_unregister(data->hwmon_dev);

out_user:

	ipmi_destroy_user(data->user);

drivers/hwmon/ina3221.c

+2 −2
Original line number Diff line number Diff line
@@ -228,7 +228,7 @@ static int ina3221_read_value(struct ina3221_data *ina, unsigned int reg, 
	 * Shunt Voltage Sum register has 14-bit value with 1-bit shift

	 * Other Shunt Voltage registers have 12 bits with 3-bit shift

	 */

	if (reg == INA3221_SHUNT_SUM)

	if (reg == INA3221_SHUNT_SUM || reg == INA3221_CRIT_SUM)

		*val = sign_extend32(regval >> 1, 14);

	else

		*val = sign_extend32(regval >> 3, 12);
@@ -465,7 +465,7 @@ static int ina3221_write_curr(struct device *dev, u32 attr, 
	 *     SHUNT_SUM: (1 / 40uV) << 1 = 1 / 20uV

	 *     SHUNT[1-3]: (1 / 40uV) << 3 = 1 / 5uV

	 */

	if (reg == INA3221_SHUNT_SUM)

	if (reg == INA3221_SHUNT_SUM || reg == INA3221_CRIT_SUM)

		regval = DIV_ROUND_CLOSEST(voltage_uv, 20) & 0xfffe;

	else

		regval = DIV_ROUND_CLOSEST(voltage_uv, 5) & 0xfff8;