Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   =?iso-8859-1?Q?Jan_Kundr=E1t?= <jan.kundrat@cesnet.cz>
To:     =?iso-8859-1?Q?V=E1clav_Kubern=E1t?= <kubernat@cesnet.cz>
Cc:     Jean Delvare <jdelvare@suse.com>,
        Guenter Roeck <linux@roeck-us.net>,
        Jonathan Corbet <corbet@lwn.net>,
        <linux-hwmon@vger.kernel.org>, <linux-doc@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 3/7] hwmon: (max31790) Allow setting pulses
Date:   Fri, 05 Mar 2021 13:08:26 +0100
MIME-Version: 1.0
Message-ID: <ad1c3054-e9a2-4299-aeed-94e36d6d3d12@cesnet.cz>
In-Reply-To: <20210304105830.507176-3-kubernat@cesnet.cz>
References: <20210304105830.507176-1-kubernat@cesnet.cz>
 <20210304105830.507176-3-kubernat@cesnet.cz>
Organization: CESNET
User-Agent: Trojita/unstable-2020-07-06; Qt/5.15.2; xcb; Linux; 
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

> @@ -285,6 +295,9 @@ static int max31790_write_fan(struct device=20
> *dev, u32 attr, int channel,
>  =09=09=09=09   MAX31790_REG_FAN_CONFIG(channel),
>  =09=09=09=09   data->fan_config[channel]);
>  =09=09break;
> +=09case hwmon_fan_pulses:
> +=09=09data->pulses[channel] =3D val;
> +=09=09break;

This needs input validation, otherwise it's possible to write 0 in there=20
and you get a division-by-zero in the kernel context:

[102109.999968] Division by zero in kernel.
[102110.003917] CPU: 1 PID: 27590 Comm: cat Not tainted 5.9.3-cla-cfb #42
[102110.010462] Hardware name: Marvell Armada 380/385 (Device Tree)
[102110.016497] [<c010f16c>] (unwind_backtrace) from [<c010ae40>]=20
(show_stack+0x10/0x14)
[102110.024355] [<c010ae40>] (show_stack) from [<c083ba30>]=20
(dump_stack+0x94/0xa8)
[102110.031689] [<c083ba30>] (dump_stack) from [<c083a3fc>]=20
(Ldiv0+0x8/0x2c)
[102110.038499] [<c083a3fc>] (Ldiv0) from [<c064c1ac>]=20
(max31790_read+0x174/0x204)
[102110.045836] [<c064c1ac>] (max31790_read) from [<c0646fdc>]=20
(hwmon_attr_show+0x44/0x138)
...

A similar error can also happen when setting the fan speed to 0 RPM.=20
That's, however, not an error caused by this patch series AFAIK. I *think*=20=

that RPM_TO_REG should be changed to check if `rpm` is 0, and if so, set=20
the register directly to the maximal value of 0x7ff (in another patch).

With kind regards,
Jan