>> >> diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c >> index 0207618..ec92aff 100644 >> --- a/drivers/hwmon/applesmc.c >> +++ b/drivers/hwmon/applesmc.c >> @@ -733,13 +733,19 @@ static ssize_t applesmc_show_temperature(struct device *dev, >> ret = applesmc_get_entry_by_index(index, &entry); >> if (ret) >> return ret; >> + if (entry.len > 2) >> + return -EINVAL; >> >> - ret = applesmc_read_entry(&entry, buffer, 2); >> + ret = applesmc_read_entry(&entry, buffer, entry.len); >> if (ret) >> return ret; >> >> - temp = buffer[0]*1000; >> - temp += (buffer[1] >> 6) * 250; >> + if (entry.len == 2) { >> + temp = buffer[0]*1000; >> + temp += (buffer[1] >> 6) * 250; >> + } else { >> + temp = buffer[0] * 4000; >> + } > > Another comment - in the next patch, you check for entry.len == 0. > If that can happen, you would need to check it here as well. It cannot happen after a succesful return from get_entry(), but I will check it again. Earlier versions used entry.len rather than entry.valid, which can still be seen in a few places. Thanks, Henrik _______________________________________________ lm-sensors mailing list lm-sensors@xxxxxxxxxxxxxx http://lists.lm-sensors.org/mailman/listinfo/lm-sensors