From nobody Mon May 25 07:36:19 2026 Received: from mail-dl1-f42.google.com (mail-dl1-f42.google.com [74.125.82.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E879F3F44FA for ; Fri, 15 May 2026 22:12:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883127; cv=none; b=ny0EfvOikldWTz8mVpTzZJ19FHrLzNNIIjRGy6ckoDaZnftztGNZt72TBAxlbcaNsRFroYl4Pwe/DViDFqoLAIGjcFCSgKJIQ470lvINnTYkTQhdsScdNZncOwkDUC3UWe9u1HQvvtcS6+06LLWUKliWfLJnDmk9r8fWGxnaFLw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883127; c=relaxed/simple; bh=+I0xhDp4SpUwbzVVvV+VuUoAZCghaJHfoyGjcmblC9o=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=W2/6U+YZktJgpXvhI9yFOrgH3GYT0WXHKVLdKj5mbcIdkCrwevLYt9k6WYmGIea2G5jetXLRJJrGAR1gK3rU1SsjI8rgYD8XL3U2CD+nPgKQnP8LSgu4ctXbVyYH5QghX4Wg9fgdD6ViRArrwfETBGvCllUdcC2XCh6W3XrpSK0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=k1DBY4R1; arc=none smtp.client-ip=74.125.82.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="k1DBY4R1" Received: by mail-dl1-f42.google.com with SMTP id a92af1059eb24-130c9dcbd25so998113c88.1 for ; Fri, 15 May 2026 15:12:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778883124; x=1779487924; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=+bfjoVc2ZTz8zNHb4moDa0nNqdOodwiu4sj42S3RCu4=; b=k1DBY4R1A4jUigR/l1ua3hyy6reD7u4N3M5OZx4Xjz3ride/Zn0AUaUOQYxYsQBlGY jdIi5zPuu7eEtLwiBqq+jSfH8dgcb8DjnB6cx0HXgS5fzzWVqJ9GBlhbz/kWpCz7KK+W tCDoyGWVMuA7FF8wLBnC0Ss7i0EOgdWh0P0AP/S6vfL6uZgAzlicwoCPlfe1Oh+KDgzk Hs9mKieDj1+sFyJ0eFbrS7c6r6MPvsRHI5avBK+ZxqIDiK2Zjv0cQWLSDgYKp6S8jSVS HmaDb94oOi5GBNWirrSS0Jqf5L5BnZ8x77LXt8lj20KEPoi7geugd9Muiklsj0dYkBhh TwxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778883124; x=1779487924; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=+bfjoVc2ZTz8zNHb4moDa0nNqdOodwiu4sj42S3RCu4=; b=Tw4/hRMqQtbmGrVS7+Wp/P+ISn7X/UpKjRdAlzosytrh4AR8xqux6R5fhL+krUlCng J8sGd4LU/3GSsfwJrczlydczglEVANKR1N92GUsPzqclgC9ukNiBoTlwdPZUMctS2J/G WAgSTwzFYTyHVMI0sfQf/mJCze6bKFrOZXQ9v0Yw1rKTxNqZeAAm0CbM1jhDSLb8xVWY 1ctxLqABfr3Lgk6JOv/d2zj52mFPPBWEPxUJKwSRLs3TKXi8+j5C6r8xETW9HqO73/cu IvOExYVbYinLfKwNzcL6/aeSUmvBTnSiI2uwK7Q6G8R24WNIf/PuRy0xHrNbt0LkpdCL wwdw== X-Forwarded-Encrypted: i=1; AFNElJ+BL6wbdvTNSSjMPTelUFnicunlvzOFfJ0g5x4Y2SwIcDiGsYSmd9Dv/zYzFlNr7nWRncn9Sf9l/KvDv/Y=@vger.kernel.org X-Gm-Message-State: AOJu0YxSNMMpCzo+R9DT55u0CR7x7aXitl1a7krUL+0BZL6/uUgoM4TA 3gAt0r5TnlLQ8zCIieITWsfYZZWDR+VHSbqMZHH77xDu09IAk8cKGazmpKDd8M95eo0LagkwMt3 u/wxNk6Q= X-Gm-Gg: Acq92OHszv8ujw7fcEcgmleHfGzxlfpuSdP5NTHMEIShjSK87HvBM4au5G3r2H0THH0 OjNqrWE9EGh3+OzYlJtYGMK2i7gmjhvYrNb3pX6WMKjlRVlqo1fA/Eri22k3k06EFU6s8qoA1L7 eilidJqYpZVFPAQOvpqurpzqHW3FPQsrhR1uznqemKQ9GJgc4mrWy7pEEVZaqFVbGNkPSxtfqiW xa1HSaatV04u1q/GDqRE7VXaBwMxwFAX56kV3gP56valqEBNr5c+xfq4vi/q/Ignc4BtTniGOmr D6XjvTj+KPjcOqjE4vQSWFFkRqlc0CyooNB2OHnZazjqYLjfVoMGw5B1NrY/SqwJHMaElNYePyS +CtUnDMPR6vtZfE8xc/pD1GtUz/ywQCOw2br+vt0EASIzRQ5V26iTR/2R6mEN1Vy/tUilrMTgXL 2MgdnOnWcPkmYJtzkqQOUqOIL+cOrD3BQ+L2OG X-Received: by 2002:a05:7300:f193:b0:2df:7882:1cf3 with SMTP id 5a478bee46e88-3025eaafc91mr5186644eec.2.1778883124281; Fri, 15 May 2026 15:12:04 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30293e2e686sm9626315eec.5.2026.05.15.15.12.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 May 2026 15:12:03 -0700 (PDT) From: Abdurrahman Hussain Date: Fri, 15 May 2026 15:11:47 -0700 Subject: [PATCH 1/5] hwmon: (pmbus/adm1266) seed timestamp from the real-time clock Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260515-adm1266-fixes-v1-1-1c1ea1349cfe@nexthop.ai> References: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> In-Reply-To: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> To: Guenter Roeck , Alexandru Tachici Cc: Jean Delvare , linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778883122; l=1424; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=+I0xhDp4SpUwbzVVvV+VuUoAZCghaJHfoyGjcmblC9o=; b=o73nMyBiu8rsMOWD3agOF7Ur1lWSxqpwjd1nw0RRSHnPxVRuX4azpL6+vHSE6K0ZX8PU5iSla PzFKl00eeRnD8r/zEL1C8y/SvMJHCj86t0Rqp9moGxxCfWoXQb8TR1f X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_set_rtc() seeds the chip's SET_RTC register from ktime_get_seconds(), which returns CLOCK_MONOTONIC -- i.e. seconds since the host last booted, not seconds since the Unix epoch. The chip stamps that value into every blackbox record it captures. Userspace reading those timestamps back expects wall-clock seconds: that's what the SET_RTC frame layout documents (datasheet Rev. D, Table 84) and what every other consumer of "seconds since epoch" assumes. Seeding from CLOCK_MONOTONIC gives blackbox records a timestamp that is only meaningful within a single boot of the host and silently resets to small values on every reboot. Switch to ktime_get_real_seconds() so the seed matches what the register is documented to hold. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain --- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index d90f8f80be8e..a86666c73a5e 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -432,7 +432,7 @@ static int adm1266_set_rtc(struct adm1266_data *data) char write_buf[6]; int i; =20 - kt =3D ktime_get_seconds(); + kt =3D ktime_get_real_seconds(); =20 memset(write_buf, 0, sizeof(write_buf)); =20 --=20 2.53.0 From nobody Mon May 25 07:36:19 2026 Received: from mail-dy1-f173.google.com (mail-dy1-f173.google.com [74.125.82.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E1E430E82D for ; Fri, 15 May 2026 22:12:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883128; cv=none; b=JQTK6CB4eAS8LgREE8SfSm87IQfPE/esd8ho7iLfXxf+YCni6AMsCOW/YB6NVijeWasN+q3HEDVpzCueTSxdQFDbqQkLjfeC2eufG7xDwMhL0ggwiFT+Q5isJh6cj1AeAYq3i3n5V7hPXSfKMxIRdYqzAh27F6GJQyJQm52stDI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883128; c=relaxed/simple; bh=YuUrT1BEnFyF/ImxIJNRuH++hsrfZzAUxyPbwt2jgrY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=UUgq/uiZd6UMV51YC+v8lODir3Ye2VyzebO2dauBmg2H2gVI5atL60NnjZPRnkJ23zzaBi2+GEBjpfXBNubj/TQvWjSUBWaKtxRxG+7QrjgQxjjUyfamNT50VNiOZj3TzGtMnWUXZibIodRDdYZE8SSO5oyf9QLqfWZnkkB46zU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=I5Yrs9tM; arc=none smtp.client-ip=74.125.82.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="I5Yrs9tM" Received: by mail-dy1-f173.google.com with SMTP id 5a478bee46e88-2f33ae12f97so1250125eec.1 for ; Fri, 15 May 2026 15:12:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778883125; x=1779487925; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=Lf1AbfbJq6OKtzU38AjcQmkVu/SnjdthMQ1Neq2C96U=; b=I5Yrs9tMQxiZpf6fOuxQk97nq51PWESCJmQx8KKmcOaq66BVukO4ecsuYvcm3A0pC2 6VtXyoVadGJOKTN2dTHcVuqcExtWUZTHbmDXiaN0uqfnnOQSlZ68zRaqNalNBX0YfeOP kOaqFdhgCX3k2DxjjDhwDIc/eUiCIIpJW8JHqOZYvnWpaUqgeLTxr6uQoKDjxei+x4AA H0JxSK7WJaqLErqXqyIAZgBgTSCuxERmMz5BQkGa1Vp4DnUmU84gXPGcrbebUjOxWQA1 22Trf/dQiv9SqwpyjTjO55bxi8jmIlgoPS0CbynbjZ411zxNlM1I13zIjzSDzG0zWms5 rUew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778883125; x=1779487925; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=Lf1AbfbJq6OKtzU38AjcQmkVu/SnjdthMQ1Neq2C96U=; b=rHx1oEnIGT3RFb/roXHjPynKFkLAoYhmp7fEucvYrKOFjY3YVH95dwoFyAQRwQmmDI O5VIjMLQ5J+1an9ntK4RTEClLj0+G0Xwf8SfItVw2wayd9hbUbSPzMxWwWW27QMWJlYP FG7S5dTV9X6hbYxp9mf34S2iXGR/mBXzA7kmqCkgRKBofNVeL69fPjXLkcIxGmYBWeQv 046eKgbiEyOAPeUhOCusclrIzY192fFmuvCrY9+Eibf7Y10/cVNjvi/geXtDAIEX/L6z y/OPQmeXk8NVzTRbku91NeuhczJ6K4nBOvPfZc7HgdIs6312SbFQFN0jNEo+6WASDMkt FERA== X-Forwarded-Encrypted: i=1; AFNElJ8AK+YHcfLVZTxqeVCfmYtVXZ0Unf+AqnJtSGzjZPOS4811gfZnd/SlzBQgQa9j/32lmEV+EoN2HxvVpwQ=@vger.kernel.org X-Gm-Message-State: AOJu0Ywq92L5tVCk1wlmyllMF253yTWNwk8rWCBFmQfenUsufMHcodet TWFnRJYD3tXjBweLFN2/brHtGXoX1lYxUabeDwDfwbMXGCJC2imiGhZNJz6c8bWBg1yyl+LCycS 2f3XJTU8= X-Gm-Gg: Acq92OFsz/jyY+j5d4ulo3Omk12EGDT5khb1IQJU1HrR0NLJsW/1J3AaVPKrc3+kxVW EoL9ixP5DV82wU2jxEfxkiVmIj+X5Zy2hQgzxHyjugLb5V+xDgZ+dYAILCVn1fguD+aJB2YD0I6 G1FppejCegWgsH78Z0xBs6onfgQLHErijnI8P35Nzyljh9fjV8daEucpXZfeuFKPg7Xh3CF4jWL Z001tuWp5tzEuQ83iqP5FVLSMnulerB+b0jN8l+PLIJZxbKMYuG958yFlY5dURGs8cq8pEkP81v wEdpXwgqwSWSMhMI0Oxsbpr0Pipp+Tpzm2YJSOmAZSt49rj7gNbO+ueXUIuPsVt4RWJPozwZkzI j/rktisnCC7YaSUcDuROSgfIcGNEBiJ/WXqyofwvsMzaKDHOEor4cuxON/Xpb4wZIpU1XoUBBN2 QJvq6sylnqu+OSl+4Wsn09qXVqo7IroufPwajw X-Received: by 2002:a05:7300:be17:b0:2f2:6dde:df67 with SMTP id 5a478bee46e88-3039862657bmr2942193eec.22.1778883125129; Fri, 15 May 2026 15:12:05 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30293e2e686sm9626315eec.5.2026.05.15.15.12.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 May 2026 15:12:04 -0700 (PDT) From: Abdurrahman Hussain Date: Fri, 15 May 2026 15:11:48 -0700 Subject: [PATCH 2/5] hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260515-adm1266-fixes-v1-2-1c1ea1349cfe@nexthop.ai> References: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> In-Reply-To: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> To: Guenter Roeck , Alexandru Tachici Cc: Jean Delvare , linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778883122; l=1590; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=YuUrT1BEnFyF/ImxIJNRuH++hsrfZzAUxyPbwt2jgrY=; b=Hkbvw8/WxKlbe9Pm3Qn0o3qVsSb8cvHHc0pzRPts595HAREP6TY9GKq/4yMbs3lGIgbYxXKGf e/EcqvM1iy6AHb7WaSHgPvXVXt3bFxRepcYluK3eKQN6k0+sI+vC2XB X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and passes it to i2c_smbus_read_block_data() to retrieve the 4-byte BLACKBOX_INFO response. i2c_smbus_read_block_data() does not honour caller buffer sizes -- it memcpy()s data.block[0] bytes from the SMBus transaction (where data.block[0] is the length byte returned by the slave device, up to I2C_SMBUS_BLOCK_MAX =3D 32): memcpy(values, &data.block[1], data.block[0]); If the device returns any block length above 5, the call overflows the caller's 5-byte stack buffer before the post-call if (ret !=3D 4) return -EIO; check has a chance to reject the response. Widen the local buffer to I2C_SMBUS_BLOCK_MAX so the helper has room for any well-formed SMBus block response, matching the convention used by the other i2c_smbus_read_block_data() callers in this driver. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain --- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index a86666c73a5e..94691dec1359 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -349,7 +349,7 @@ static int adm1266_nvmem_read_blackbox(struct adm1266_d= ata *data, u8 *read_buff) { int record_count; char index; - u8 buf[5]; + u8 buf[I2C_SMBUS_BLOCK_MAX]; int ret; =20 ret =3D i2c_smbus_read_block_data(data->client, ADM1266_BLACKBOX_INFO, bu= f); --=20 2.53.0 From nobody Mon May 25 07:36:19 2026 Received: from mail-dy1-f176.google.com (mail-dy1-f176.google.com [74.125.82.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A46B43F44EA for ; Fri, 15 May 2026 22:12:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883129; cv=none; b=UwFELNwh7b4mVy8IIpFQ6VKUjEJ9wh+Ipb8xyzosmWp8KPvTyo5vQ2u5HigHX1GlTImnsy2RyPDTfAdlZFgzmlfif6zH8TCM5+aeYYfYJpyplzdLT3y0OkTcdwart1SQW2siaDYpPXzSpjCwEyXu22+08BiH29sNlglpfSh9EzY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883129; c=relaxed/simple; bh=ETivrwyXTq+z+Tc9f8R+CJ4bEtqYJQZwPgtTKbESsR8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=odOxVWQEtHsMGBOQEF+t0C9KYYnx5jzgMCYjq+bgzIdTYs/BTDOd7Q3ToLLM3kLyeKRj5Py9JbCRL+/l2geMrvVzgm7zeI1BanGBvLFil8OWohljSt6VG8+d29r3kXjUr7EDBl86R6KCYG2KPHEudw6/KLTUpPsF//46Jt+Tqo8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=NJ1liADs; arc=none smtp.client-ip=74.125.82.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="NJ1liADs" Received: by mail-dy1-f176.google.com with SMTP id 5a478bee46e88-2f0ad52830cso455442eec.1 for ; Fri, 15 May 2026 15:12:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778883126; x=1779487926; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=VK26/8ZVBf9AU0/JWVkP19gRCj8fh89lDWUebzaejUk=; b=NJ1liADsROPs6MI1VskgSPEiKEBv5K8RpAzTUZDHhIR2VBApk/ngU0/CYej7i+QzYQ PqvQeKV1um2cJYTyD67/5+RP0cFeFXuMbKNutbTRWHoeVs7GS8cLhEZyH5WQwEs/KMYl 9rrB6+brdtGlk3PmLxnkKSCX7/zvf389CjG0MUetgD389CAyeUJ0QqKdFsUWce1iY1pg s2nbI4phVhRXk0Bn/q1Dfoo70B0UDgBQgVidRtYvzECPyyT92lh9pL0wOlxZ3Y6yXM55 p0gCb/QBcIKEJg05VXuNuZuL3RCS6swV9eBy1Kjpfy/+NT1vwoaB7f6wjaBDFmwYdX3e EItQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778883126; x=1779487926; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=VK26/8ZVBf9AU0/JWVkP19gRCj8fh89lDWUebzaejUk=; b=Xklv9nq1txChSqUGHOz7LxlBbgQ3EZRbYacRPO7wQ2495aZsaHbj1F96cVVx2aD7Hs AOaBRf12dQ+SBT9S/ERJ0dDSpgHuPZk4Ra8RgOWhOIc0Ss+amYd06+YdqrkvpPGakvyy FUus3ySP0bTfPtPYxGpegNlHYnORPPLkw6KwFayXJ236gcGsbI/mw67d6EbaGZ59dpro uEuthh8KYrK+SLmejyjtLKwaueYOVwy+abXt1bOJK9Qm5qyiHNtF7eEf5BuroMtzphD+ NTAScsfBveKnEmxcYXRIaZiOysVkuqtLf06FumAp8dCONKTNTvZMtCN0Uau0rqhHeFHY V4tQ== X-Forwarded-Encrypted: i=1; AFNElJ+T9PNE2n1qfowR+MTG00hQJ8IVlXcgZv3Ky5OgOuv/AC/UpP56EsqkfFTWIGVLnFOeeANpqr1nJ6otHe8=@vger.kernel.org X-Gm-Message-State: AOJu0YwF/Fa6qKDIXjMP9oYzAIfq65wPIJVI8PdRgYXZRfpHuyZtmeI0 m+HneLi6pbofZGaZNShFJWI4yBI5VwMwVwU3EJcahPoozlS/J32ehlu2tTX5q55sZOHjzoh4Zw+ 4wS7EMhw= X-Gm-Gg: Acq92OEsZvroA28u1CWctzdRmhGe01X3N9o7iwpZ2xGH38iU4HbEHj9xJMrmRbytZ0N 9C1qbfzVOQhfaLEGMKyQ9EMO1gKf08osvGq9qlW131UPoa8Bu+ZFuq/jW/kopNFOsp65F0awKX6 /JAdd3jR6iyANPu/Ncq/rFiYr3OpMr0mOWSk23YZaZUhanpOmKvBqmq5wKt5+AlNn9SZZ5+tW19 A6PYO71pXQtoxU5/9LSK2VK5mWyip9K/AqFnjxXlahikPtRRFR3WueCwS0vgpTyU34Q/0duQxc3 TjGYh2219q68cW7YI0zSgCfXnYklZLK0YvFUnUEdlqO4rv5bmKSNZAdMpJRgutYBGoqVKKhC/kA fMfulfZut7tOCmNONrRDKIUXnPwjQiS9DThAvaTSqSJfOMz8mxuDrVKE+zC3ybDmXOc32M32Lrr Okmyg0LKpBUWKmuxTulwZXMTWPXA== X-Received: by 2002:a05:7300:2216:b0:2ea:edc0:4fbe with SMTP id 5a478bee46e88-3039818a842mr2935169eec.14.1778883126240; Fri, 15 May 2026 15:12:06 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30293e2e686sm9626315eec.5.2026.05.15.15.12.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 May 2026 15:12:05 -0700 (PDT) From: Abdurrahman Hussain Date: Fri, 15 May 2026 15:11:49 -0700 Subject: [PATCH 3/5] hwmon: (pmbus/adm1266) reject implausible blackbox record_count Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260515-adm1266-fixes-v1-3-1c1ea1349cfe@nexthop.ai> References: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> In-Reply-To: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> To: Guenter Roeck , Alexandru Tachici Cc: Jean Delvare , linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778883122; l=1706; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=ETivrwyXTq+z+Tc9f8R+CJ4bEtqYJQZwPgtTKbESsR8=; b=8SOiEV2agb7TI1iKZEnDC91LZaCRSpz0eGiAL3QdL8dFrPyfdiPlcPRE3IrlB+eRS+Lsy9s4Z vh7m3FRKHa3CNcO24bG0fgz5UMOGhblHfQwXn03pugAXPUmz0F0jXLE X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_nvmem_read_blackbox() loops over a record_count that comes straight from byte 3 of the BLACKBOX_INFO response. The destination buffer is data->dev_mem, sized for the nvmem cell's declared 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE =3D 32 * 64). A device that reports a record_count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read_buff past the end of the dev_mem allocation on the trailing iterations. Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX_INFO response cannot drive the loop out of bounds. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain --- drivers/hwmon/pmbus/adm1266.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 94691dec1359..43d9e7407795 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -46,6 +46,7 @@ =20 #define ADM1266_BLACKBOX_OFFSET 0 #define ADM1266_BLACKBOX_SIZE 64 +#define ADM1266_BLACKBOX_MAX_RECORDS 32 =20 #define ADM1266_PMBUS_BLOCK_MAX 255 =20 @@ -360,6 +361,8 @@ static int adm1266_nvmem_read_blackbox(struct adm1266_d= ata *data, u8 *read_buff) return -EIO; =20 record_count =3D buf[3]; + if (record_count > ADM1266_BLACKBOX_MAX_RECORDS) + return -EIO; =20 for (index =3D 0; index < record_count; index++) { ret =3D adm1266_pmbus_block_xfer(data, ADM1266_READ_BLACKBOX, 1, &index,= read_buff); --=20 2.53.0 From nobody Mon May 25 07:36:19 2026 Received: from mail-dl1-f42.google.com (mail-dl1-f42.google.com [74.125.82.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB94E3EFFDF for ; Fri, 15 May 2026 22:12:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883130; cv=none; b=Kr/lNYKrmrto054fbGBe+k/MizAR7iBLuB+n8hHotNCQJp1OATCDwA5EP/vkMkWkJBWn4m54M5BvWZq/Fr7XSeHArZPgQbqNcPOHO8BGYk8yEZQ5hRRY4cAz91F6kIce9unUyLEwb+Fm2dlBOaE/V3jBi7h9qZH/F3WXXLR+jW4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883130; c=relaxed/simple; bh=rP04PKwq1R/PP8JxrqExEG/Wa23i/3eww37NNCWqAhQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ZCN4byDfYoBRuGq3WWC+zbd1HEyZ4P3EiyifSANHYH0KrabBazIqr6UA/wgZb6sgqW9Q2C2YRbud4OrkRUy2Y+hTTEtSwOgEmfk3YTBHpYPSCudb9QdDE/VoQuYug1HSmhkFTHZq81ds3RYOmEs+Jl3pLnWBcv2rU5cWYj5H/c8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=EFTofA3/; arc=none smtp.client-ip=74.125.82.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="EFTofA3/" Received: by mail-dl1-f42.google.com with SMTP id a92af1059eb24-132d1b2519eso950106c88.0 for ; Fri, 15 May 2026 15:12:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778883127; x=1779487927; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=7X1kg6LzQMAP+o8E3PxdhGDCIvH3ZXQrhfmA4xsA6sM=; b=EFTofA3/8HbrcNDNLfDf9H4iqTlnrAZ9z8NBXS83a28ScmhFadv6/YmPDiQE0eBT1h VgOd6bY0ved+4dVTd287jcmIk3wDODO/Q4gSr4XhvdRglb3TS6AOa8e7sa0IkvGR5Eka F8xGy1uvu9cDjCNssGa7IfEAIL+VvU+uqPNQOjgE/EjwHulLZQXVW9YyLCVNWyShZ0VT IxBuoo/jtMVyfjtOWah18s9BLL1BXkT5iYFRvbmxCMTFIR+Vz8/KBTIVfVP4xVz1jOQb K48abYssYY/7+/SdLfLQR+w60PBF1X2fwIPx/8Fd8/i0DwRFFiFcZMXpVKvnu22eXp7i Ywng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778883127; x=1779487927; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=7X1kg6LzQMAP+o8E3PxdhGDCIvH3ZXQrhfmA4xsA6sM=; b=CLsCISW4DiiCea1MMK3LddN1s9VKTswS662OAoztSgdFedU44b9G7KDaIRFb422YyA /A7oDTf88Z4QUhOrXcMa/4h76Go0L8EEjOPypxpjCVE1zY9OdWjkYzgx3YIdcRKpbkjv tzsTAemQhUu9HWqtlUeT2J8i96AsqVA7LlvzQM4YkO5p3ZYRUEN2wFintxeJf/7naqxd miuU9JPTdmnycLWffTcpo6oaDH1ASqr1EmXeHcR22b4CPoawMH6DyowqJlqc40PmaA8C YER6IwE+OhT5H+BmZdntUq9FdgxJQFjAW4KsJIC8y/iRTLqJvS4KCIse7/+yXejibhVO /igw== X-Forwarded-Encrypted: i=1; AFNElJ+t36DFxSxIaOUcbpRlFsjxxs68V2KCb3tJFJy61MLu59hLNZx/zu63oE7mUTuH1qDpMxaaJ9ZAi6LrtDw=@vger.kernel.org X-Gm-Message-State: AOJu0Yw/gk2fA7gM2auofMuz/GuDTrWzlOPncS8Mw1UbJWr4EoKgK3Ss 2lV0kErr2LGgB3QGQczqwXMQsV/NctSVc8BPHgpntKQwsB/ZrtuH7cZLUDQQclIon2UYwVVYoR/ Jbf5oMbA= X-Gm-Gg: Acq92OF0aTAVwuhkyya4gIowI/CirEH4aazRqo4U/lFe+5eT8aNLfY6vPIt9oxn7LQ3 WEhjICdB3LMn5xjRyi0sY/euAJ5ojtqKcDna9GM/K7WPxqPJzu8w7AMJhW1v6N+wEbXyXOe2maj pMuoJeHfaVpaTluvgnRjQlGb9C9Fy3FJ39YRLTsPHSxFF3BY6SO+lzx4Fz6eZT2DIplkWS3dC28 dITGxFoLw+bLCKgUJp3Uch73jHt3eoxyQ2zxh7kFvej4kqBAGmYmG+wfdLANAgqpVSuJb8pDbC4 00fo6dNO2uDG8/fLkxozqldUyrbIbydinuWFZGqxGu8ohs0ve1mxdagyZtrpvBlAj1hop+eyA7n TaM4A0FtP/JmUemgljjUp8Tnod4Cy8A+Mlg4ODCDS+vezIWohp3uOo/odgQezY0FrAxX5/18+Q0 6FYXH6t/kDQ0Opgp4E6gKsCN6rJQ== X-Received: by 2002:a05:7022:fa1:b0:133:54fb:f563 with SMTP id a92af1059eb24-1350473aa89mr2644596c88.23.1778883126994; Fri, 15 May 2026 15:12:06 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30293e2e686sm9626315eec.5.2026.05.15.15.12.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 May 2026 15:12:06 -0700 (PDT) From: Abdurrahman Hussain Date: Fri, 15 May 2026 15:11:50 -0700 Subject: [PATCH 4/5] hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260515-adm1266-fixes-v1-4-1c1ea1349cfe@nexthop.ai> References: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> In-Reply-To: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> To: Guenter Roeck , Alexandru Tachici Cc: Jean Delvare , linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778883122; l=1565; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=rP04PKwq1R/PP8JxrqExEG/Wa23i/3eww37NNCWqAhQ=; b=2PNAO62DaJBNERe0/MaLo76D8o3WxNJxlnvyAB4KhOkACv+TmFuzh+cmzBM2k7B5wA4y02Xqo cC+jqrpbA3zCAvG9GXTyQMbl1cO2ngh7hRPx241ZkZxnr9Dc3zaszXX X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_pmbus_block_xfer() sets up the read transaction with .buf =3D data->read_buf, .len =3D ADM1266_PMBUS_BLOCK_MAX + 2, but read_buf in struct adm1266_data is declared as u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1]; For a max-length block response (length byte =3D 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of read_buf. The same response also makes the subsequent PEC compare if (crc !=3D msgs[1].buf[msgs[1].buf[0] + 1]) read a byte beyond the array. Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2c_msg length already accounts for. Fixes: 407dc802a9c0 ("hwmon: (pmbus/adm1266) Add Block process call") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain --- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 43d9e7407795..5c68e3177f64 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -61,7 +61,7 @@ struct adm1266_data { u8 *dev_mem; struct mutex buf_mutex; u8 write_buf[ADM1266_PMBUS_BLOCK_MAX + 1] ____cacheline_aligned; - u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1] ____cacheline_aligned; + u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 2] ____cacheline_aligned; }; =20 static const struct nvmem_cell_info adm1266_nvmem_cells[] =3D { --=20 2.53.0 From nobody Mon May 25 07:36:19 2026 Received: from mail-dy1-f177.google.com (mail-dy1-f177.google.com [74.125.82.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E92C3F5BD2 for ; Fri, 15 May 2026 22:12:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883131; cv=none; b=OxZW71av9yI8iXv6fLpyl+2k360kmigqj0n1mpbU0WsHsJEQxhacuMAs1+Sb+gr5unbBpWo+IlODBw5QjBsCgvkuN28ryOT42sUfH2kulo+FJS0k1Abfxh1355rT7Yk/oE0cQiYsCaNi3umA4Er9q1BSewMW2BTInKntYV2sCKc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778883131; c=relaxed/simple; bh=zhxWqJ52Q6qTGKwBiQNGvijQCBuYkpUO7Y7g9BcLdgc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=NF+ELEUFj3ITTkgq0QZq1o6LtESjNndhv2wjsbkD1n9JZsWlHz+nohi4xvH2dxsiAvDGo7gPxCJX9FwWUwT9m/ccxme/8DJOuIcLSJxeJneVVKVh+zIDCrxTDjPJ0k7wHmZOGTvsEBrJL7KpUYWDlO7dq4IT75cBDDtNR3kGn30= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=N3nqLF9q; arc=none smtp.client-ip=74.125.82.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="N3nqLF9q" Received: by mail-dy1-f177.google.com with SMTP id 5a478bee46e88-2ee990e8597so890565eec.1 for ; Fri, 15 May 2026 15:12:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778883128; x=1779487928; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=/JhuDfTWcij+46AVt9XxVF2c8YtBvHsSklz5Uok9QCw=; b=N3nqLF9qNrSnolynR+RLfz2vD1FZliEtVHUW0qaZEMCkg1rtqcBR0VmZ1fqbZWhUzK hOOyHEVyX5akc8aL7AYXWMrOGGBVmH+/0dHyo0vxQs5pilbFWOJ+FOhZ1zV9OCOrCfq8 s2CmOHzyU84KFQ0QW0tNcFVEGqq7HL/c0HTCOxaiLbqTo97FRHqcRBoyyPL01qLUNxCO Q+ROv2gd5oCr6WMVuHZLxSP6zCfajRmLs6RzmFxpWLAdFQvC5AQriLx215IonzmTAZX8 5DHo0dhYa35srx09ADCQ3E2QipcW7DdNaOzhxuckIiYtk4Vxp2HD1xO+woV9jWuCYcAH sn2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778883128; x=1779487928; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=/JhuDfTWcij+46AVt9XxVF2c8YtBvHsSklz5Uok9QCw=; b=LyslbKcDHLIAPkJ9lb83mO2m1iZHqxz0SW7DiZfbt/P843stcehxDxjBDoOIkfLCJP +tjINkclVfYvr6VZwMH9bsRFtCw0TFNKS4XHmmPH1zc0U+K6Gjowz62MGido40WeRVrY /CwPlpjoA4K8GWxZqCggHFUPpqV7GKIxZDcAK3CGmujKTcito1qLMJ94KvE5mZZBGkMQ i0S4EvxcI8bz+6XKE+MRrm0FEPqRIrk1MnGp6lNu+qTPWCfBTUCIpkYlOBL5u4QjmhHu HKkl4Kw6cXIj2B1m277MNlWHYIx6RaVeCJuVhG9mPkxLPSqX3puNjdd0yKbZLxNjLaPv 42qw== X-Forwarded-Encrypted: i=1; AFNElJ+i7mSWkqEYkE7tJT1mglLVmLXyFE5xnZMoZNy1yvXnlk5/JCT8kqBDFjFPM6xmqlBgIDkqauCEsZ2iIqA=@vger.kernel.org X-Gm-Message-State: AOJu0YxZ/wVgOlV28joQTDg40iTBlJb/vFrg+Kmfl/foH4940rjcXMe6 1O+EWNOtMaW+0RHun325ar44q1a40E4JK0/gjAlZeuriJr8ZaEzz00tWEsda/6JxLu/pQYh9rZ9 lNgtit5w= X-Gm-Gg: Acq92OEGA0IVcnzxbJF4QSRz6sKHvYovrr65NIen8nlpp58IGvOlUKNshA/xiSrZtKl vLdFYgE8Ovzue7mG6IVJTqTexYqLcOszOtNPngerwek0ZX/Ng5KPIRK7RBaKJX2IQ9tKIMJwsnU 8bqgidaQeqaOdPN+WNEFAMXLSgzjFNGh7sZdGpGhiyO/HCA2tsx123KDCrWSP0+IXvrkicml1Ls aTYBro44YQazZ8qDiQOzzNre9AqoLHg/tl35/LhIZBp54uYd6VvLSegDOLkstIIogzqSv8c3MAI 2DnsuW2IrMjDi9NECPf+QzBagkJ/FH08km+CUEHGM0AgzRy6gprFdSMyT2+2y62zcQ232R4j2Ft dRrXxCqm+XxS9wiaisXmHfnzI/98PA4MC7Jl7wVqojbqEfc6b3Q1yMHD2j9sJ9Ih+v/IY77+nV4 h9mn6wwVb5GkuOuH4vsIyLjVIANN7j8QbRZXcy X-Received: by 2002:a05:7300:a907:b0:2f0:c8b5:3dc7 with SMTP id 5a478bee46e88-30398680c36mr2939435eec.22.1778883127883; Fri, 15 May 2026 15:12:07 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30293e2e686sm9626315eec.5.2026.05.15.15.12.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 May 2026 15:12:07 -0700 (PDT) From: Abdurrahman Hussain Date: Fri, 15 May 2026 15:11:51 -0700 Subject: [PATCH 5/5] hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260515-adm1266-fixes-v1-5-1c1ea1349cfe@nexthop.ai> References: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> In-Reply-To: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> To: Guenter Roeck , Alexandru Tachici Cc: Jean Delvare , linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778883122; l=2365; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=zhxWqJ52Q6qTGKwBiQNGvijQCBuYkpUO7Y7g9BcLdgc=; b=e1uT0b11Dc+0JWe2IgewP/RzSkfCoMezb1XvRg+F7LvPJul78o2w22ZbaNVCLYoaSlvq4aNte Y3T+uz3DvJhAt3FHAuGdhFzdqnXaTNrnB9eKQgSSDRuPhqoUqLA56Ze X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_pmbus_block_xfer() copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]); The helper does not know how large data_r is and trusts the device to return at most one record's worth of bytes. adm1266_nvmem_read_blackbox() violates that contract: it advances read_buff inside data->dev_mem in ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns more than 64 bytes on the trailing record (read_buff offset 1984 in the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes before the post-call if (ret !=3D ADM1266_BLACKBOX_SIZE) return -EIO; can reject the response. Contain the fix in the caller without changing the helper signature: read each record into a 255-byte local bounce buffer that matches the helper's maximum output, validate the returned length, and only then copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot. Fixes: 407dc802a9c0 ("hwmon: (pmbus/adm1266) Add Block process call") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain --- drivers/hwmon/pmbus/adm1266.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 5c68e3177f64..ea1edb89d2a0 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -348,6 +348,7 @@ static void adm1266_init_debugfs(struct adm1266_data *d= ata) =20 static int adm1266_nvmem_read_blackbox(struct adm1266_data *data, u8 *read= _buff) { + u8 record[ADM1266_PMBUS_BLOCK_MAX]; int record_count; char index; u8 buf[I2C_SMBUS_BLOCK_MAX]; @@ -365,13 +366,14 @@ static int adm1266_nvmem_read_blackbox(struct adm1266= _data *data, u8 *read_buff) return -EIO; =20 for (index =3D 0; index < record_count; index++) { - ret =3D adm1266_pmbus_block_xfer(data, ADM1266_READ_BLACKBOX, 1, &index,= read_buff); + ret =3D adm1266_pmbus_block_xfer(data, ADM1266_READ_BLACKBOX, 1, &index,= record); if (ret < 0) return ret; =20 if (ret !=3D ADM1266_BLACKBOX_SIZE) return -EIO; =20 + memcpy(read_buff, record, ADM1266_BLACKBOX_SIZE); read_buff +=3D ADM1266_BLACKBOX_SIZE; } =20 --=20 2.53.0