diff options
authorJean Delvare <khali@linux-fr.org>2005-08-25 18:43:37 +0200
committerLinus Torvalds <torvalds@g5.osdl.org>2005-08-26 16:31:46 -0700
commit3fd1bb9baa394856b112e5edbfd3893d92dd1149 (patch)
parent566ecb9b258ec4da3c7e1c6ca6fca8a5bb0c8eba (diff)
[PATCH] hwmon: Off-by-one error in fscpos driver
Coverity uncovered an off-by-one error in the fscpos driver, in function set_temp_reset(). Writing to the temp3_reset sysfs file will lead to an array overrun, in turn causing an I2C write to a random register of the FSC Poseidon chip. Additionally, writing to temp1_reset and temp2_reset will not work as expected. The fix is straightforward. Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hwmon/fscpos.c b/drivers/hwmon/fscpos.c
index 270015b626ad..301ae98bd0ad 100644
--- a/drivers/hwmon/fscpos.c
+++ b/drivers/hwmon/fscpos.c
@@ -167,7 +167,7 @@ static ssize_t set_temp_reset(struct i2c_client *client, struct fscpos_data
"experience to the module author.\n");
/* Supported value: 2 (clears the status) */
- fscpos_write_value(client, FSCPOS_REG_TEMP_STATE[nr], 2);
+ fscpos_write_value(client, FSCPOS_REG_TEMP_STATE[nr - 1], 2);
return count;