linux-kernel - Re: [PATCH 3/7] hwmon: (max31790) Allow setting pulses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 05 Mar 2021 13:08:26 +0100
From:   Jan Kundrát <jan.kundrat@...net.cz>
To:     Václav Kubernát <kubernat@...net.cz>
Cc:     Jean Delvare <jdelvare@...e.com>,
        Guenter Roeck <linux@...ck-us.net>,
        Jonathan Corbet <corbet@....net>,
        <linux-hwmon@...r.kernel.org>, <linux-doc@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 3/7] hwmon: (max31790) Allow setting pulses

> @@ -285,6 +295,9 @@ static int max31790_write_fan(struct device 
> *dev, u32 attr, int channel,
>  				   MAX31790_REG_FAN_CONFIG(channel),
>  				   data->fan_config[channel]);
>  		break;
> +	case hwmon_fan_pulses:
> +		data->pulses[channel] = val;
> +		break;

This needs input validation, otherwise it's possible to write 0 in there 
and you get a division-by-zero in the kernel context:

[102109.999968] Division by zero in kernel.
[102110.003917] CPU: 1 PID: 27590 Comm: cat Not tainted 5.9.3-cla-cfb #42
[102110.010462] Hardware name: Marvell Armada 380/385 (Device Tree)
[102110.016497] [<c010f16c>] (unwind_backtrace) from [<c010ae40>] 
(show_stack+0x10/0x14)
[102110.024355] [<c010ae40>] (show_stack) from [<c083ba30>] 
(dump_stack+0x94/0xa8)
[102110.031689] [<c083ba30>] (dump_stack) from [<c083a3fc>] 
(Ldiv0+0x8/0x2c)
[102110.038499] [<c083a3fc>] (Ldiv0) from [<c064c1ac>] 
(max31790_read+0x174/0x204)
[102110.045836] [<c064c1ac>] (max31790_read) from [<c0646fdc>] 
(hwmon_attr_show+0x44/0x138)
...

A similar error can also happen when setting the fan speed to 0 RPM. 
That's, however, not an error caused by this patch series AFAIK. I *think* 
that RPM_TO_REG should be changed to check if `rpm` is 0, and if so, set 
the register directly to the maximal value of 0x7ff (in another patch).

With kind regards,
Jan