[PATCH] hwmon: (sg2042-mcu) reject short uptime reads

uptime_show() asks for two bytes and only rejects a negative return:

	u8 time_val[2];

	ret = i2c_smbus_read_i2c_block_data(mcu->client, REG_UPTIME,
					    sizeof(time_val), time_val);
	if (ret < 0)
		return ret;

	return sprintf(buf, "%d\n",
		       (time_val[0]) | (time_val[1] << 8));

i2c_smbus_read_i2c_block_data() returns the number of bytes the transfer
actually produced, which the device supplies and which can be shorter
than the length asked for:

	memcpy(values, &data.block[1], data.block[0]);
	return data.block[0];

time_val is not initialised, so a reply of one byte leaves the high half
of the reported uptime as whatever was on the stack, and a reply of zero
bytes leaks both halves. Either way the value ends up in sysfs.

Require the full two bytes. The other registers this driver reads go
through i2c_smbus_read_byte_data(), which returns the byte itself, so
the existing negative-only checks are right there.

Fixes: 758b62e562f2 ("hwmon: Add sophgo SG2042 external hardware monitor support")
Cc: [email protected]
Signed-off-by: Ali Ahmet Memis <[email protected]>
---
 drivers/hwmon/sg2042-mcu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwmon/sg2042-mcu.c b/drivers/hwmon/sg2042-mcu.c
index 591f5f572fe4..10292417e766 100644
--- a/drivers/hwmon/sg2042-mcu.c
+++ b/drivers/hwmon/sg2042-mcu.c
@@ -79,6 +79,8 @@ static ssize_t uptime_show(struct device *dev,
 					    sizeof(time_val), time_val);
 	if (ret < 0)
 		return ret;
+	if (ret != sizeof(time_val))
+		return -EIO;
 
 	return sprintf(buf, "%d\n",
 		       (time_val[0]) | (time_val[1] << 8));

base-commit: 2d2338c93da79b3bfe4b6099a931d9468d539952
-- 
2.55.0