diff options
| author | Nikita Zhandarovich <n.zhandarovich@fintech.ru> | 2023-05-10 17:35:37 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-07-19 17:21:19 +0300 |
| commit | 280e58d8b0e902556fa0c8dddc622ea9ea19af91 (patch) | |
| tree | 6edf13b33fb101f204be81d9b489e63a0059b096 /drivers/hwmon | |
| parent | 08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba (diff) | |
| download | linux-280e58d8b0e902556fa0c8dddc622ea9ea19af91.tar.xz | |
hwmon: (f71882fg) prevent possible division by zero
[ Upstream commit 0babf89c9cca7e074d6e59893e462e4886f481cc ]
In the unlikely event that something goes wrong with the device and
its registers, the fan_from_reg() function may return 0. This value
will cause a division-by-zero error in the show_pwm() function.
To prevent this, test the value of
fan_from_reg(data->fan_full_speed[nr]) against 0 before performing
the division. If the division-by-zero error is avoided, assign 0 to
the val variable.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: df9ec2dae094 ("hwmon: (f71882fg) Reorder symbols to get rid of a few forward declarations")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://lore.kernel.org/r/20230510143537.145060-1-n.zhandarovich@fintech.ru
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/hwmon')
| -rw-r--r-- | drivers/hwmon/f71882fg.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c index 70121482a617..27207ec6f7fe 100644 --- a/drivers/hwmon/f71882fg.c +++ b/drivers/hwmon/f71882fg.c @@ -1096,8 +1096,11 @@ static ssize_t show_pwm(struct device *dev, val = data->pwm[nr]; else { /* RPM mode */ - val = 255 * fan_from_reg(data->fan_target[nr]) - / fan_from_reg(data->fan_full_speed[nr]); + if (fan_from_reg(data->fan_full_speed[nr])) + val = 255 * fan_from_reg(data->fan_target[nr]) + / fan_from_reg(data->fan_full_speed[nr]); + else + val = 0; } mutex_unlock(&data->update_lock); return sprintf(buf, "%d\n", val); |