When writing the update_interval attribute, the parameter value was not range checked, which could cause an integer overflow and result in an arbitrary update interval. Fix by limiting the value range to <0, 100000>. Reported-by: Jean Delvare <khali@xxxxxxxxxxxx> Signed-off-by: Guenter Roeck <linux@xxxxxxxxxxxx> --- drivers/hwmon/lm90.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c index bdfd675..d2dd5f9 100644 --- a/drivers/hwmon/lm90.c +++ b/drivers/hwmon/lm90.c @@ -917,7 +917,7 @@ static ssize_t set_update_interval(struct device *dev, return err; mutex_lock(&data->update_lock); - lm90_set_convrate(client, data, val); + lm90_set_convrate(client, data, SENSORS_LIMIT(val, 0, 100000)); mutex_unlock(&data->update_lock); return count; -- 1.7.5.4 _______________________________________________ lm-sensors mailing list lm-sensors@xxxxxxxxxxxxxx http://lists.lm-sensors.org/mailman/listinfo/lm-sensors
