Commit 6eaafbb6 authored by Julien Folly's avatar Julien Folly Committed by Greg Kroah-Hartman
Browse files

w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u for... 


w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u for unsigned, count for max size).

IAD Register is yet readable trough the "iad" sys file.

A write to the "iad" sys file enables or disables the current
measurement, but it was not possible to get the measured value by
reading it.
Fix: %u in snprintf for unsigned values (vdd and vad)
Fix: Avoid possibles overflows (Usage of the 'count' variables)

Signed-off-by: default avatarJulien Folly <julien.folly@gmail.com>
Acked-by: default avatarEvgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3c3f7624

drivers/w1/slaves/w1_ds2438.c

+52 −14
Original line number Diff line number Diff line
@@ -186,7 +186,7 @@ static int w1_ds2438_change_config_bit(struct w1_slave *sl, u8 mask, u8 value) 
	return -1;

}



static uint16_t w1_ds2438_get_voltage(struct w1_slave *sl,

static int w1_ds2438_get_voltage(struct w1_slave *sl,

				 int adc_input, uint16_t *voltage)

{

	unsigned int retries = W1_DS2438_RETRIES;
@@ -235,6 +235,25 @@ post_unlock: 
	return ret;

}



static int w1_ds2438_get_current(struct w1_slave *sl, int16_t *voltage)

{

	u8 w1_buf[DS2438_PAGE_SIZE + 1 /*for CRC*/];

	int ret;



	mutex_lock(&sl->master->bus_mutex);



	if (w1_ds2438_get_page(sl, 0, w1_buf) == 0) {

		/* The voltage measured across current sense resistor RSENS. */

		*voltage = (((int16_t) w1_buf[DS2438_CURRENT_MSB]) << 8) | ((int16_t) w1_buf[DS2438_CURRENT_LSB]);

		ret = 0;

	} else

		ret = -1;



	mutex_unlock(&sl->master->bus_mutex);



	return ret;

}



static ssize_t iad_write(struct file *filp, struct kobject *kobj,

			 struct bin_attribute *bin_attr, char *buf,

			 loff_t off, size_t count)
@@ -257,6 +276,27 @@ static ssize_t iad_write(struct file *filp, struct kobject *kobj, 
	return ret;

}



static ssize_t iad_read(struct file *filp, struct kobject *kobj,

			struct bin_attribute *bin_attr, char *buf,

			loff_t off, size_t count)

{

	struct w1_slave *sl = kobj_to_w1_slave(kobj);

	int ret;

	int16_t voltage;



	if (off != 0)

		return 0;

	if (!buf)

		return -EINVAL;



	if (w1_ds2438_get_current(sl, &voltage) == 0) {

		ret = snprintf(buf, count, "%i\n", voltage);

	} else

		ret = -EIO;



	return ret;

}



static ssize_t page0_read(struct file *filp, struct kobject *kobj,

			  struct bin_attribute *bin_attr, char *buf,

			  loff_t off, size_t count)
@@ -272,9 +312,13 @@ static ssize_t page0_read(struct file *filp, struct kobject *kobj, 


	mutex_lock(&sl->master->bus_mutex);



	/* Read no more than page0 size */

	if (count > DS2438_PAGE_SIZE)

		count = DS2438_PAGE_SIZE;



	if (w1_ds2438_get_page(sl, 0, w1_buf) == 0) {

		memcpy(buf, &w1_buf, DS2438_PAGE_SIZE);

		ret = DS2438_PAGE_SIZE;

		memcpy(buf, &w1_buf, count);

		ret = count;

	} else

		ret = -EIO;
@@ -289,7 +333,6 @@ static ssize_t temperature_read(struct file *filp, struct kobject *kobj, 
{

	struct w1_slave *sl = kobj_to_w1_slave(kobj);

	int ret;

	ssize_t c = PAGE_SIZE;

	int16_t temp;



	if (off != 0)
@@ -298,8 +341,7 @@ static ssize_t temperature_read(struct file *filp, struct kobject *kobj, 
		return -EINVAL;



	if (w1_ds2438_get_temperature(sl, &temp) == 0) {

		c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", temp);

		ret = PAGE_SIZE - c;

		ret = snprintf(buf, count, "%i\n", temp);

	} else

		ret = -EIO;
@@ -312,7 +354,6 @@ static ssize_t vad_read(struct file *filp, struct kobject *kobj, 
{

	struct w1_slave *sl = kobj_to_w1_slave(kobj);

	int ret;

	ssize_t c = PAGE_SIZE;

	uint16_t voltage;



	if (off != 0)
@@ -321,8 +362,7 @@ static ssize_t vad_read(struct file *filp, struct kobject *kobj, 
		return -EINVAL;



	if (w1_ds2438_get_voltage(sl, DS2438_ADC_INPUT_VAD, &voltage) == 0) {

		c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", voltage);

		ret = PAGE_SIZE - c;

		ret = snprintf(buf, count, "%u\n", voltage);

	} else

		ret = -EIO;
@@ -335,7 +375,6 @@ static ssize_t vdd_read(struct file *filp, struct kobject *kobj, 
{

	struct w1_slave *sl = kobj_to_w1_slave(kobj);

	int ret;

	ssize_t c = PAGE_SIZE;

	uint16_t voltage;



	if (off != 0)
@@ -344,15 +383,14 @@ static ssize_t vdd_read(struct file *filp, struct kobject *kobj, 
		return -EINVAL;



	if (w1_ds2438_get_voltage(sl, DS2438_ADC_INPUT_VDD, &voltage) == 0) {

		c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", voltage);

		ret = PAGE_SIZE - c;

		ret = snprintf(buf, count, "%u\n", voltage);

	} else

		ret = -EIO;



	return ret;

}



static BIN_ATTR(iad, S_IRUGO | S_IWUSR | S_IWGRP, NULL, iad_write, 1);

static BIN_ATTR(iad, S_IRUGO | S_IWUSR | S_IWGRP, iad_read, iad_write, 0);

static BIN_ATTR_RO(page0, DS2438_PAGE_SIZE);

static BIN_ATTR_RO(temperature, 0/* real length varies */);

static BIN_ATTR_RO(vad, 0/* real length varies */);

CRA Git | Maintained and supported by SUSTech CRA and CCSE