From nobody Mon May 25 07:36:16 2026 Received: from mail-dy1-f175.google.com (mail-dy1-f175.google.com [74.125.82.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F8463793CB for ; Sat, 16 May 2026 20:45:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778964321; cv=none; b=J0bSRn1FhplEx7uvBYdZ+76Z3uiSQ34/oRWVHDFYT/OqLC9yuY7qCLgJZoPQErGpBYO7yKMgp00dUjOB7iCyiouXMH7q4/9Tpj2xceMnwU/Hefw3OYKs1AViIpehOEe36HHTeeclthFFSuzbrF+3Gz+/W/f88owq7QAEqwL2V8Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778964321; c=relaxed/simple; bh=thK+U+aplsDzvE5oAtB1E2JzEzfbWfLwgItKOTLlb8o=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=iT9J+ITMI0GHeF2c4aTzTZ5uS6XVJFadM8VpsWOwxUi1ducgUL7GfxgKASMvdO3fttI2w0EX9nClnZ3+bxQlbEFFp/iIX7ntCvljgD5NVHOGy4YBRU8jEpcJaZQkJW+kyAEZevXj8cffj8eLrQGpc7liXEz0DoaymUTkWxi3SUY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=ZCdoBKlP; arc=none smtp.client-ip=74.125.82.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="ZCdoBKlP" Received: by mail-dy1-f175.google.com with SMTP id 5a478bee46e88-3025d725a05so3523477eec.1 for ; Sat, 16 May 2026 13:45:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778964316; x=1779569116; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=lN2ucZVsVYmHc/fedXjm4iB8oy6SqWjHFEKRvCBYgl8=; b=ZCdoBKlP2IBwldcKYmxqIQ0gAOx7ZbuEWUsF0Z7HucEx+ipTHfTctxv/bVkllEygb9 cmx7eIbKql51eurkJcpJwXi5EAG/FaeDXpEw76qUkby2CXKx9zUtr7rePwhml/HHdMaE Qqe6ZUb8iQaZ96mitufci0jFLdXCiFlYzHg0l/Bpvf796fMKsjK/B70/X8Mq2c5YM1kA S0uf/+sAOsF1zIoxuGnGiVvYsDEoIz+PSmmxLVq7PXwvrW8wVbJnqXC0tuWUjAGk45TU xaIduO903BY/XERBCG4hyzwy5gydXMsEnCd4HH4esfQjNjY3mL0rvSklYvIV5IESkjCf GSEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778964316; x=1779569116; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=lN2ucZVsVYmHc/fedXjm4iB8oy6SqWjHFEKRvCBYgl8=; b=AAE9h9Ybu82siqNp42J9PT89SoLUSoaFgc9ACXumks7noe9PJG56wiXX924XRLGfwW JEsxhRzDBjojnFJcpYhg0o1Gsu9QGBsPdF+LaoHuFPETgfbenmgTTz+erT+/1SMwblm1 Kf6kUT0mDh6W93GBgj+NMgBGwv1kONFCdC8i2Ok3Myhi/JgNwG8x2kI381S6Nx29FPEn Dk4Vcg//MHhdGOCOMqncaKt3Dywlh+wyeiTTBr08hHYtz94sSviOCrFBUfubdeHcCwf4 lI+QDaQAGt3mf0Vt3xz6ztzApp1bKa3WXVhm9WbniZFJAln/XFg3eEobNjEnXeuHciOc iGCA== X-Forwarded-Encrypted: i=1; AFNElJ9U2jop6GRRzIgG6GgjY5+BCEGzgkaWvnJuk8+E7ae53ng/nF6Tz+stvvojGU32oF7iZcMDrQHJUSfTQ4Q=@vger.kernel.org X-Gm-Message-State: AOJu0YxeaIv2SNOZqR9XitOm3kKSaIlUQg3sJZYkbOl2oWCQAP8guV9D 2nN6DutSEHb4czKCP326HcF4W+w8NG6yfrPHbQ4/oN3lT4XZMcvza8v88EGgAsu7KVc= X-Gm-Gg: Acq92OHAvRlCxu9zye6MqBpLCR9V0YY7sPtlEeIDPzupV1W6BEeSXU3xM+vyAuJrYMu BEGWFCncjCrr+DDjWfSLusDvAiY80HrZOVM24u5ZZHK3xslZq7F8KMtnpi5isEbcncazbJAQ7/P MLVv+pLfc+R8I3PiCMV0YlmQLHJmM3BvpcFZ7ZXWSyTRvoMzeuCBfPtEd81Zt6t3SQKVphd50Bw ajCTjm+IDwdgaAL5vFf7UZJXOj7sPjVQ3ZiwJCtVGzy28UKlIktqJaGEv8odoEQaBW7JX0E0VbW 9kNh0hHRsAk0pQHaJ527GvxWxSm59Tslqs6wmq8oASFOewdgFP74qzXDORvTEYkNSwMDrAsUbbo 0VLZzPyG5lSs8bJ0rkfl7Fn4ZGDtRmrm0ik9/ZxNGvn/6wjn4NnOMIxJIoavVQI98HAR/irqo1j flfbSuzXPyBWCGa2h7zqfZXU/BQA== X-Received: by 2002:a05:7300:be17:b0:2d8:7302:d21 with SMTP id 5a478bee46e88-303986010e1mr4012564eec.16.1778964315801; Sat, 16 May 2026 13:45:15 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-302947e917dsm10181189eec.12.2026.05.16.13.45.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 16 May 2026 13:45:15 -0700 (PDT) From: Abdurrahman Hussain Date: Sat, 16 May 2026 13:45:06 -0700 Subject: [PATCH 1/2] hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260516-adm1266-gpio-fixes-v1-1-38d9dd39b905@nexthop.ai> References: <20260516-adm1266-gpio-fixes-v1-0-38d9dd39b905@nexthop.ai> In-Reply-To: <20260516-adm1266-gpio-fixes-v1-0-38d9dd39b905@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778964314; l=1733; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=thK+U+aplsDzvE5oAtB1E2JzEzfbWfLwgItKOTLlb8o=; b=BjxUI7bCnZQeFpZr2VOSAEtl2SLHMs+Oa3mHpajmk0LAPHOhdXEZlhdAym/1bSbWC3erZwg9R mT6xHQTW0CMC+SUgxRZG1FK3c7FXPaM2P+/QHUrJpOofreLG2DY6l2t X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR =3D 25. gpiolib hands in a mask sized for gc.ngpio (=3D 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 27 extra unsigned-long words of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Linus Walleij --- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index d90f8f80be8e..11f9a44f4361 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -211,7 +211,7 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask status =3D read_buf[0] + (read_buf[1] << 8); =20 *bits =3D 0; - for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATU= S) { + for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { if (test_bit(gpio_nr - ADM1266_GPIO_NR, &status)) set_bit(gpio_nr, bits); } --=20 2.53.0 From nobody Mon May 25 07:36:16 2026 Received: from mail-dy1-f181.google.com (mail-dy1-f181.google.com [74.125.82.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 106FF379C30 for ; Sat, 16 May 2026 20:45:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778964322; cv=none; b=utVACsJSXk7PkLrB5vApuDSwaC0nYoWYd8jeKjd+rHIupRTU5ZAU0/5ByagKfbiXWfSxCA6uc2wyMaRspgCQfwm7h0t6sMOdvHmfctoS3rbIvXyqtOwropmhKb41jbfGBtH+gTBONGQ5SAW+GrYe2ba28HMrm+t+REx1OOcJ7mI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778964322; c=relaxed/simple; bh=RfhWyhkILQ9JdmZHbT+RrfNjTCyKMG4R356hSwJe3G8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=O/u2MxU+wGkQ8VOkeu3HqC01jx2+xQ0bByojUze1JgFEFu4TMYqdvffk1KMZRVTsJV33ohwQ/nlKUIZLanzS728QEue+4vZdTXeOLk8Fq6xXRXRa+R0Xw5ZqCbS4N8F1BEBc4IEbO7234Z/F7oOoHqcZv+bk2MB3yLM3/lDN3i8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=ZcgUXt5p; arc=none smtp.client-ip=74.125.82.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="ZcgUXt5p" Received: by mail-dy1-f181.google.com with SMTP id 5a478bee46e88-2ef8d6ba48bso445972eec.1 for ; Sat, 16 May 2026 13:45:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778964317; x=1779569117; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=oAd95b7/1qRCPRUMfS/TXEKMP5bhCN7d3v6gwbzEek0=; b=ZcgUXt5pkLED9dRjEbySF2v7MT+6DaSl7KSguC6Rq8CKXdld+Hk9wtpT5Xs9sCajnU TBZP29I0Jmii0ka7JaM4NrRjS2ToJM533aGIR/lp+6KomRGR/AxwN5Tek16pesydCkTM jnSTaKuEC3siK2oBXZjVMqEJ3PFO3W2IlAW+Xk5Oqbzl+SKaIlzsDwNgHhNL0BqMHHym LcV5lYR3oXKY5UkBNqpe62U9RZCZ3u1qQOYTcFPhfOrDTuwPXKNBX3WGzWz1EWeH3lBH ee5Ugz8iaiWC/wC39QDzxIOy7so6xm/sAC2irVGuTDCrqKk+4CSrtCd7PMNH+rnVM+wy h6Ng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778964317; x=1779569117; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=oAd95b7/1qRCPRUMfS/TXEKMP5bhCN7d3v6gwbzEek0=; b=N4nk6Vev2Qk0vfIGXnVJFoHUccY0KHH2ePcXp+G/NXz+C/b4RJzcNgfE9W6HfHbopK jTRvJDE7UXz8h2GZZOYh93mBlDM12Yf5m+bwYV7e3KlMXYf6mN7tVlm/+9nUKthWky4a Gjn8ygYDaNakhY/cIgnZWJ50Aq/kMO2gA7+eq3RzUIEt9DJ77quPE+ejzBo6ph26AiWP R+yBjm1B4z31megp+Vgxwreq921+WEWuzwVSXlbcDvmtzDBpU4ruzCvj5xdoEWbEhx1L H+v1+UeHVq1UChMioayScH6GNnTOn+wrY3e6KYRBO1U7JwJ6CkwV7Ojv6k6dA3BNyOmA h94g== X-Forwarded-Encrypted: i=1; AFNElJ9oTb4chrnL5XudISWNrSRt0mb6FedjsoBuIPtGQIdF3CDzNUKqmbt+F5ftG6Koy162RggP2pbrpgs5dhM=@vger.kernel.org X-Gm-Message-State: AOJu0YwyMMS2mjzVEvtvv/SpG5O8dVYOZKoaCmRGrPLpJja+jfK2ppKW e/Vlrqd2x4ymCyek6noJlMvB/3gUlFdIpRqsT5KEApz/DHL8NEvCYiXSF4EbzwCEywfQksggtDx HDbes79Y= X-Gm-Gg: Acq92OEdblCjC5ea12gcZD7od2YVQVgpILhT2i3OlDGSTlS9JAA+qpvVSMpGx2/Krmq JFEwgjdq+OeosbvnOa1D5ysSldZ/1mnupn2tgTR4UEzzUfoLZznOHLsTiQ736/KKUziZtw7nbZ1 2QmBSN/txym6C5XsjlAuualGgFGwR5YqZDIGTbuAUKME3jkTpe+U53Dy7arZejQc9M8ALlP3GBd YmfveSOWKumUscjG7VVCitH81alNGf5vcZkiN3MdQxORGKRvkFvfSe2nfWPIWopXKFh6PKFTCLH mPxl17H1RX1KIUXM8Fex9qH3lt8oNk6T+Tdefaz2iNzi0hX9e/2fVzy2MJWmjNmsGRgGeFWtw2w /Ge20QLLrNXdDquAz9miUjPSHttzR7KDO6VsTcknmiiaovWpECw3k0OA2YiyUI1YszmmxXP3lBo MLNRzEdea474f3mWL2hoI57XqcaiYW3QCePTF//Cg8nF88Xok= X-Received: by 2002:a05:7300:5786:b0:2f4:d190:37bf with SMTP id 5a478bee46e88-30261e7524emr5925773eec.16.1778964316535; Sat, 16 May 2026 13:45:16 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-302947e917dsm10181189eec.12.2026.05.16.13.45.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 16 May 2026 13:45:16 -0700 (PDT) From: Abdurrahman Hussain Date: Sat, 16 May 2026 13:45:07 -0700 Subject: [PATCH 2/2] hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260516-adm1266-gpio-fixes-v1-2-38d9dd39b905@nexthop.ai> References: <20260516-adm1266-gpio-fixes-v1-0-38d9dd39b905@nexthop.ai> In-Reply-To: <20260516-adm1266-gpio-fixes-v1-0-38d9dd39b905@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778964314; l=1492; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=RfhWyhkILQ9JdmZHbT+RrfNjTCyKMG4R356hSwJe3G8=; b=w7SBG8WKVytyc0UPa0IqJNBMBW0tyJp01IO5+hbO9NQmQBlE6iXe90w1vbz3ZaaylqfT9gY4u YEdqDozT+oCAAJQBxYRgvdBEZB0qsql1Lf0Al0oe+SSsx08B+L0eayD X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get_multiple() zeroes *bits before the GPIO_STATUS loop and then a second time before the PDIO_STATUS loop: *bits =3D 0; for_each_set_bit(gpio_nr, mask, ADM1266_GPIO_NR) { ... set_bit(gpio_nr, bits); } ret =3D i2c_smbus_read_block_data(data->client, ADM1266_PDIO_STATUS, ...); ... *bits =3D 0; for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { ... set_bit(gpio_nr, bits); } The second *bits =3D 0 throws away every GPIO bit the first loop just populated, so callers asking for any combination of GPIO and PDIO pins always see the GPIO portion of the returned bits as zero. Drop the redundant second assignment so both halves of the result survive. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Linus Walleij --- drivers/hwmon/pmbus/adm1266.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 11f9a44f4361..4dd67c02b412 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -210,7 +210,6 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask =20 status =3D read_buf[0] + (read_buf[1] << 8); =20 - *bits =3D 0; for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { if (test_bit(gpio_nr - ADM1266_GPIO_NR, &status)) set_bit(gpio_nr, bits); --=20 2.53.0