On Fri, Dec 21, 2018 at 01:10:39PM -0600, Kangjie Lu wrote: > In lm80_probe(), if lm80_read_value() fails, it returns a negative > error number which is stored to data->fan[f_min] and will be further > used. We should avoid using the data if the read fails. > > The fix checks if lm80_read_value() fails, and if so, returns with the > error number. > > Signed-off-by: Kangjie Lu <kjlu@xxxxxxx> Applied. Thanks, Guenter > --- > drivers/hwmon/lm80.c | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) > > diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c > index d91333557f04..85f797501aaf 100644 > --- a/drivers/hwmon/lm80.c > +++ b/drivers/hwmon/lm80.c > @@ -627,6 +627,7 @@ static int lm80_probe(struct i2c_client *client, > struct device *dev = &client->dev; > struct device *hwmon_dev; > struct lm80_data *data; > + int rv; > > data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL); > if (!data) > @@ -639,8 +640,14 @@ static int lm80_probe(struct i2c_client *client, > lm80_init_client(client); > > /* A few vars need to be filled upon startup */ > - data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1)); > - data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2)); > + rv = lm80_read_value(client, LM80_REG_FAN_MIN(1)); > + if (rv < 0) > + return rv; > + data->fan[f_min][0] = rv; > + rv = lm80_read_value(client, LM80_REG_FAN_MIN(2)); > + if (rv < 0) > + return rv; > + data->fan[f_min][1] = rv; > > hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, > data, lm80_groups);
