Showing error 1719

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: drivers/hwmon/lm75.c
Line in file: 101
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-10 20:24:52 UTC


Source:

  1/*
  2    lm75.c - Part of lm_sensors, Linux kernel modules for hardware
  3             monitoring
  4    Copyright (c) 1998, 1999  Frodo Looijaard <frodol@dds.nl>
  5
  6    This program is free software; you can redistribute it and/or modify
  7    it under the terms of the GNU General Public License as published by
  8    the Free Software Foundation; either version 2 of the License, or
  9    (at your option) any later version.
 10
 11    This program is distributed in the hope that it will be useful,
 12    but WITHOUT ANY WARRANTY; without even the implied warranty of
 13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 14    GNU General Public License for more details.
 15
 16    You should have received a copy of the GNU General Public License
 17    along with this program; if not, write to the Free Software
 18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 19*/
 20
 21#include <linux/module.h>
 22#include <linux/init.h>
 23#include <linux/slab.h>
 24#include <linux/jiffies.h>
 25#include <linux/i2c.h>
 26#include <linux/hwmon.h>
 27#include <linux/hwmon-sysfs.h>
 28#include <linux/err.h>
 29#include <linux/mutex.h>
 30#include "lm75.h"
 31
 32
 33/*
 34 * This driver handles the LM75 and compatible digital temperature sensors.
 35 * Only types which are _not_ listed in I2C_CLIENT_INSMOD_*() need to be
 36 * listed here.  We start at 9 since I2C_CLIENT_INSMOD_*() currently allow
 37 * definition of up to 8 chip types (plus zero).
 38 */
 39
 40enum lm75_type {                /* keep sorted in alphabetical order */
 41        ds1775 = 9,
 42        ds75,
 43        /* lm75 -- in I2C_CLIENT_INSMOD_1() */
 44        lm75a,
 45        max6625,
 46        max6626,
 47        mcp980x,
 48        stds75,
 49        tcn75,
 50        tmp100,
 51        tmp101,
 52        tmp175,
 53        tmp275,
 54        tmp75,
 55};
 56
 57/* Addresses scanned */
 58static const unsigned short normal_i2c[] = { 0x48, 0x49, 0x4a, 0x4b, 0x4c,
 59                                        0x4d, 0x4e, 0x4f, I2C_CLIENT_END };
 60
 61/* Insmod parameters */
 62I2C_CLIENT_INSMOD_1(lm75);
 63
 64
 65/* The LM75 registers */
 66#define LM75_REG_CONF                0x01
 67static const u8 LM75_REG_TEMP[3] = {
 68        0x00,                /* input */
 69        0x03,                /* max */
 70        0x02,                /* hyst */
 71};
 72
 73/* Each client has this additional data */
 74struct lm75_data {
 75        struct device                *hwmon_dev;
 76        struct mutex                update_lock;
 77        u8                        orig_conf;
 78        char                        valid;                /* !=0 if registers are valid */
 79        unsigned long                last_updated;        /* In jiffies */
 80        u16                        temp[3];        /* Register values,
 81                                                   0 = input
 82                                                   1 = max
 83                                                   2 = hyst */
 84};
 85
 86static int lm75_read_value(struct i2c_client *client, u8 reg);
 87static int lm75_write_value(struct i2c_client *client, u8 reg, u16 value);
 88static struct lm75_data *lm75_update_device(struct device *dev);
 89
 90
 91/*-----------------------------------------------------------------------*/
 92
 93/* sysfs attributes for hwmon */
 94
 95static ssize_t show_temp(struct device *dev, struct device_attribute *da,
 96                         char *buf)
 97{
 98        struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
 99        struct lm75_data *data = lm75_update_device(dev);
100        return sprintf(buf, "%d\n",
101                       LM75_TEMP_FROM_REG(data->temp[attr->index]));
102}
103
104static ssize_t set_temp(struct device *dev, struct device_attribute *da,
105                        const char *buf, size_t count)
106{
107        struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
108        struct i2c_client *client = to_i2c_client(dev);
109        struct lm75_data *data = i2c_get_clientdata(client);
110        int nr = attr->index;
111        long temp = simple_strtol(buf, NULL, 10);
112
113        mutex_lock(&data->update_lock);
114        data->temp[nr] = LM75_TEMP_TO_REG(temp);
115        lm75_write_value(client, LM75_REG_TEMP[nr], data->temp[nr]);
116        mutex_unlock(&data->update_lock);
117        return count;
118}
119
120static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO,
121                        show_temp, set_temp, 1);
122static SENSOR_DEVICE_ATTR(temp1_max_hyst, S_IWUSR | S_IRUGO,
123                        show_temp, set_temp, 2);
124static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_temp, NULL, 0);
125
126static struct attribute *lm75_attributes[] = {
127        &sensor_dev_attr_temp1_input.dev_attr.attr,
128        &sensor_dev_attr_temp1_max.dev_attr.attr,
129        &sensor_dev_attr_temp1_max_hyst.dev_attr.attr,
130
131        NULL
132};
133
134static const struct attribute_group lm75_group = {
135        .attrs = lm75_attributes,
136};
137
138/*-----------------------------------------------------------------------*/
139
140/* device probe and removal */
141
142static int
143lm75_probe(struct i2c_client *client, const struct i2c_device_id *id)
144{
145        struct lm75_data *data;
146        int status;
147        u8 set_mask, clr_mask;
148        int new;
149
150        if (!i2c_check_functionality(client->adapter,
151                        I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA))
152                return -EIO;
153
154        data = kzalloc(sizeof(struct lm75_data), GFP_KERNEL);
155        if (!data)
156                return -ENOMEM;
157
158        i2c_set_clientdata(client, data);
159        mutex_init(&data->update_lock);
160
161        /* Set to LM75 resolution (9 bits, 1/2 degree C) and range.
162         * Then tweak to be more precise when appropriate.
163         */
164        set_mask = 0;
165        clr_mask = (1 << 0)                        /* continuous conversions */
166                | (1 << 6) | (1 << 5);                /* 9-bit mode */
167
168        /* configure as specified */
169        status = lm75_read_value(client, LM75_REG_CONF);
170        if (status < 0) {
171                dev_dbg(&client->dev, "Can't read config? %d\n", status);
172                goto exit_free;
173        }
174        data->orig_conf = status;
175        new = status & ~clr_mask;
176        new |= set_mask;
177        if (status != new)
178                lm75_write_value(client, LM75_REG_CONF, new);
179        dev_dbg(&client->dev, "Config %02x\n", new);
180
181        /* Register sysfs hooks */
182        status = sysfs_create_group(&client->dev.kobj, &lm75_group);
183        if (status)
184                goto exit_free;
185
186        data->hwmon_dev = hwmon_device_register(&client->dev);
187        if (IS_ERR(data->hwmon_dev)) {
188                status = PTR_ERR(data->hwmon_dev);
189                goto exit_remove;
190        }
191
192        dev_info(&client->dev, "%s: sensor '%s'\n",
193                data->hwmon_dev->bus_id, client->name);
194
195        return 0;
196
197exit_remove:
198        sysfs_remove_group(&client->dev.kobj, &lm75_group);
199exit_free:
200        i2c_set_clientdata(client, NULL);
201        kfree(data);
202        return status;
203}
204
205static int lm75_remove(struct i2c_client *client)
206{
207        struct lm75_data *data = i2c_get_clientdata(client);
208
209        hwmon_device_unregister(data->hwmon_dev);
210        sysfs_remove_group(&client->dev.kobj, &lm75_group);
211        lm75_write_value(client, LM75_REG_CONF, data->orig_conf);
212        i2c_set_clientdata(client, NULL);
213        kfree(data);
214        return 0;
215}
216
217static const struct i2c_device_id lm75_ids[] = {
218        { "ds1775", ds1775, },
219        { "ds75", ds75, },
220        { "lm75", lm75, },
221        { "lm75a", lm75a, },
222        { "max6625", max6625, },
223        { "max6626", max6626, },
224        { "mcp980x", mcp980x, },
225        { "stds75", stds75, },
226        { "tcn75", tcn75, },
227        { "tmp100", tmp100, },
228        { "tmp101", tmp101, },
229        { "tmp175", tmp175, },
230        { "tmp275", tmp275, },
231        { "tmp75", tmp75, },
232        { /* LIST END */ }
233};
234MODULE_DEVICE_TABLE(i2c, lm75_ids);
235
236/* Return 0 if detection is successful, -ENODEV otherwise */
237static int lm75_detect(struct i2c_client *new_client, int kind,
238                       struct i2c_board_info *info)
239{
240        struct i2c_adapter *adapter = new_client->adapter;
241        int i;
242
243        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA |
244                                     I2C_FUNC_SMBUS_WORD_DATA))
245                return -ENODEV;
246
247        /* Now, we do the remaining detection. There is no identification-
248           dedicated register so we have to rely on several tricks:
249           unused bits, registers cycling over 8-address boundaries,
250           addresses 0x04-0x07 returning the last read value.
251           The cycling+unused addresses combination is not tested,
252           since it would significantly slow the detection down and would
253           hardly add any value. */
254        if (kind < 0) {
255                int cur, conf, hyst, os;
256
257                /* Unused addresses */
258                cur = i2c_smbus_read_word_data(new_client, 0);
259                conf = i2c_smbus_read_byte_data(new_client, 1);
260                hyst = i2c_smbus_read_word_data(new_client, 2);
261                if (i2c_smbus_read_word_data(new_client, 4) != hyst
262                 || i2c_smbus_read_word_data(new_client, 5) != hyst
263                 || i2c_smbus_read_word_data(new_client, 6) != hyst
264                 || i2c_smbus_read_word_data(new_client, 7) != hyst)
265                        return -ENODEV;
266                os = i2c_smbus_read_word_data(new_client, 3);
267                if (i2c_smbus_read_word_data(new_client, 4) != os
268                 || i2c_smbus_read_word_data(new_client, 5) != os
269                 || i2c_smbus_read_word_data(new_client, 6) != os
270                 || i2c_smbus_read_word_data(new_client, 7) != os)
271                        return -ENODEV;
272
273                /* Unused bits */
274                if (conf & 0xe0)
275                        return -ENODEV;
276
277                /* Addresses cycling */
278                for (i = 8; i < 0xff; i += 8)
279                        if (i2c_smbus_read_byte_data(new_client, i + 1) != conf
280                         || i2c_smbus_read_word_data(new_client, i + 2) != hyst
281                         || i2c_smbus_read_word_data(new_client, i + 3) != os)
282                                return -ENODEV;
283        }
284
285        /* NOTE: we treat "force=..." and "force_lm75=..." the same.
286         * Only new-style driver binding distinguishes chip types.
287         */
288        strlcpy(info->type, "lm75", I2C_NAME_SIZE);
289
290        return 0;
291}
292
293static struct i2c_driver lm75_driver = {
294        .class                = I2C_CLASS_HWMON,
295        .driver = {
296                .name        = "lm75",
297        },
298        .probe                = lm75_probe,
299        .remove                = lm75_remove,
300        .id_table        = lm75_ids,
301        .detect                = lm75_detect,
302        .address_data        = &addr_data,
303};
304
305/*-----------------------------------------------------------------------*/
306
307/* register access */
308
309/* All registers are word-sized, except for the configuration register.
310   LM75 uses a high-byte first convention, which is exactly opposite to
311   the SMBus standard. */
312static int lm75_read_value(struct i2c_client *client, u8 reg)
313{
314        int value;
315
316        if (reg == LM75_REG_CONF)
317                return i2c_smbus_read_byte_data(client, reg);
318
319        value = i2c_smbus_read_word_data(client, reg);
320        return (value < 0) ? value : swab16(value);
321}
322
323static int lm75_write_value(struct i2c_client *client, u8 reg, u16 value)
324{
325        if (reg == LM75_REG_CONF)
326                return i2c_smbus_write_byte_data(client, reg, value);
327        else
328                return i2c_smbus_write_word_data(client, reg, swab16(value));
329}
330
331static struct lm75_data *lm75_update_device(struct device *dev)
332{
333        struct i2c_client *client = to_i2c_client(dev);
334        struct lm75_data *data = i2c_get_clientdata(client);
335
336        mutex_lock(&data->update_lock);
337
338        if (time_after(jiffies, data->last_updated + HZ + HZ / 2)
339            || !data->valid) {
340                int i;
341                dev_dbg(&client->dev, "Starting lm75 update\n");
342
343                for (i = 0; i < ARRAY_SIZE(data->temp); i++) {
344                        int status;
345
346                        status = lm75_read_value(client, LM75_REG_TEMP[i]);
347                        if (status < 0)
348                                dev_dbg(&client->dev, "reg %d, err %d\n",
349                                                LM75_REG_TEMP[i], status);
350                        else
351                                data->temp[i] = status;
352                }
353                data->last_updated = jiffies;
354                data->valid = 1;
355        }
356
357        mutex_unlock(&data->update_lock);
358
359        return data;
360}
361
362/*-----------------------------------------------------------------------*/
363
364/* module glue */
365
366static int __init sensors_lm75_init(void)
367{
368        return i2c_add_driver(&lm75_driver);
369}
370
371static void __exit sensors_lm75_exit(void)
372{
373        i2c_del_driver(&lm75_driver);
374}
375
376MODULE_AUTHOR("Frodo Looijaard <frodol@dds.nl>");
377MODULE_DESCRIPTION("LM75 driver");
378MODULE_LICENSE("GPL");
379
380module_init(sensors_lm75_init);
381module_exit(sensors_lm75_exit);