[PATCH] hwmon: (w83627hf) fix out of bounds read of PWM register array

w83627hf_update_device() reads PWM registers in a loop bounded by a
hard coded "i <= 2", i.e. three iterations, for every chip type. For
the W83627HF, W836X7HF_REG_PWM() indexes regpwm_627hf[], which only has
two entries. The third iteration therefore reads regpwm_627hf[2], one
element past the end of the array, and issues a read of a non existent
PWM register.

The W83627HF has only two PWM outputs (datasheet registers CR5A and
CR5B, corresponding to W83627HF_REG_PWM1/PWM2) it has no third PWM
register, and the driver correctly does not expose pwm3 for this chip.
The function already computes num_pwms for this purpose, but the
loop did not use it, and num_pwms itself did not account for the
W83627HF having two PWMs.

Include the W83627HF in the two PWM case and bound the loop by num_pwms
so each chip only reads the PWM registers it actually has.

Found by smatch. Compile tested only, I do not have the hardware.

Signed-off-by: Mark Sercombe <[email protected]>
---
 drivers/hwmon/w83627hf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
index bb993bb09f40..e2cb7e8aeae3 100644
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -478,7 +478,7 @@ static struct w83627hf_data *w83627hf_update_device(struct device *dev)
 {
 	struct w83627hf_data *data = dev_get_drvdata(dev);
 	int i, num_temps = (data->type == w83697hf) ? 2 : 3;
-	int num_pwms = (data->type == w83697hf) ? 2 : 3;
+	int num_pwms = (data->type == w83627hf || data->type == w83697hf) ? 2 : 3;
 
 	mutex_lock(&data->update_lock);
 
@@ -506,7 +506,7 @@ static struct w83627hf_data *w83627hf_update_device(struct device *dev)
 			    w83627hf_read_value(data,
 					       W83627HF_REG_FAN_MIN(i));
 		}
-		for (i = 0; i <= 2; i++) {
+		for (i = 0; i < num_pwms; i++) {
 			u8 tmp = w83627hf_read_value(data,
 				W836X7HF_REG_PWM(data->type, i));
 			/* bits 0-3 are reserved  in 627THF */
-- 
2.55.0