From nobody Mon May 25 07:36:20 2026 Received: from mail-dl1-f42.google.com (mail-dl1-f42.google.com [74.125.82.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1C97E39A7FD for ; Sat, 16 May 2026 23:18:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973538; cv=none; b=Amwh28sQXv0MHCQedoK8oAZaiWCFMdpU3PlXbUy1e62K48b7hwzKZkRXuGMwhNJC72v43d8sk9qjyAsniGPVKpmBosYLXcnzScwI/HXrwPe4P2ZKip7ZtUWJiRYZ4xhXfFc/toCQk2pv15MTHuquZNfJZd9HeKa1U7SniXdloi8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973538; c=relaxed/simple; bh=thK+U+aplsDzvE5oAtB1E2JzEzfbWfLwgItKOTLlb8o=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=YhB1DGHGfiVz/VOmg1+GgbjKhl0wlTPZjkts2QKGh4jrdpBg/xQ8iH7I4LGKT7nchD1gmrop+SqnSup7gE1YJZZP8CuBk/dy0iPcfTLcFdlkqHTT+ffOyjvsrlBg63yrpvQrGqNd/KsClZyoDo+mHzM7RYkh6ZrFPWzPkgKauzE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=ec3/zuIy; arc=none smtp.client-ip=74.125.82.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="ec3/zuIy" Received: by mail-dl1-f42.google.com with SMTP id a92af1059eb24-1329fc4bf77so1695357c88.1 for ; Sat, 16 May 2026 16:18:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778973536; x=1779578336; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=lN2ucZVsVYmHc/fedXjm4iB8oy6SqWjHFEKRvCBYgl8=; b=ec3/zuIylWmNyF4ErEUEVXgMmIZWo+JOLC3mR3s4sYlWLNLP7EXm19bK9tzxHaCLs8 MXZtVOdXix+6pFRluYMmDZ6HEz95E6qJScPMjIfazPsrfM6lNswYXwASLXdrS0pmeJhU olaseSqIkBibR37kkl1RJ8G9FipEtHaozvN6sZtf6Ht4mFNQLvRr7Z61tDdToHyEwaSd nnIqdJhZRT9BxWaW9e19gdjE0GuhyHqjm+wzjzfmqG3ZhGGhE5vs5hTcz7z8VKoa9iKO d+PbDOXiNfE4tqdwES1VX6ZnrmLrg94ZYNcOMLF5kHv1inog50bTgiZh1Z56xfzzZUIC zwJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778973536; x=1779578336; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=lN2ucZVsVYmHc/fedXjm4iB8oy6SqWjHFEKRvCBYgl8=; b=ApsHdB/TyBzG/rKxYVDlkTQ/0UL5R7qqfNph+HQXBKEGDoFBDXv3IaQe/lCizpnIyi 6RH6al1rJuPFziwcNytkwmdA3pPzh+26rKVvrlZDWEQYeU8wVAR/Ob/Vh05QMh1AVNfg D4nz3/qRHdlne1pkfid9E0ZclevOE5xRcayiZJInlbEAyE85Q7aKfd2IqlOoT/0PR04u eHrz7WbyFwxOdwBodZIyYjNVquR0UamX12Ubjng2f+91kBQeXQe/Hm+Du308oW614+By fNdu87jt1NAFb37QNHXlfYjZZOsTlvidYe/N1qknSELX10xPTHgKcUN1xc9NMfPcpSbQ p/jA== X-Forwarded-Encrypted: i=1; AFNElJ/LtMX76k3R1tR8ysjjnpGebWgyWdXOsxylIdpg3Wrg4IF6MHpBvvEuRoXZN9wzbLzfE+Rkj+pb0oTi6Mg=@vger.kernel.org X-Gm-Message-State: AOJu0Yx52KCcXpBk+O05BYh5yRFG1V+RcqpNfatuK7yOzCY4VP7gwlUg q3NVMxi10ask7rk/pny+s8+6eAP7HZ08rZJ3710o/65Y+mu3FUSVnDTFoso6PiZB1lU= X-Gm-Gg: Acq92OHjhIqRIqG35W/A/FVUaQuIvHTrcuk9n7Y5ueY5bOtAEBQAbvrQOof2Hi3A4QF DTjosMkDa7a2OE3ChA+rMc0xyNBeJ/f3ZE5dJeWUYBDRkCRle3WRs+Uuj1oA/JFQbGi5fY2+N/w na0DbWqzJjpUzkTSdKiUuNVMDTz1J2ZAV6ul0/gVmsRtZE8WJBXQOpTyj35wltLouNSINMLKXQO cHDz3UoMvV8V5VKecpUUMqnuKNAq3qSh00eImdmo3A28BrdZxp0qkpZWrs34nZjRniUc+eosnpQ ledGzQRwW26EbMgYTdFk5eOWlfAeHSYRpL7Bgr/L6jHFzLQQubLQrS/g6iqJW27uSSFPdkFPpgg 14KTSrsVmVC+Mm02NYcUtN+jQs1LHoaB9D3nUZsTcq5Ee5GhJF8eCQlCeClTGqXU/UZNmmra44G jxueUGUfJj8QivH9hKihpO1dxCew== X-Received: by 2002:a05:7022:1e11:b0:12b:fc21:874d with SMTP id a92af1059eb24-1350484e801mr4444938c88.19.1778973535989; Sat, 16 May 2026 16:18:55 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb9ef5sm14722254c88.2.2026.05.16.16.18.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 16 May 2026 16:18:55 -0700 (PDT) From: Abdurrahman Hussain Date: Sat, 16 May 2026 16:18:47 -0700 Subject: [PATCH v2 1/5] hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260516-adm1266-gpio-fixes-v2-1-801f13debcb2@nexthop.ai> References: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> In-Reply-To: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778973534; l=1733; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=thK+U+aplsDzvE5oAtB1E2JzEzfbWfLwgItKOTLlb8o=; b=I6OAmp2RxAcmwLKzCCeOM0Ia4BG/LH1GF96pjVwPwoMjmJ4TSDJyB1AHR0JHVt+dP7eMIaj2K NhdRaP+yjdTD/X4ye+j9la+4q7uttfOlXCOP5UXtUkUe2KCqXBCVi0f X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR =3D 25. gpiolib hands in a mask sized for gc.ngpio (=3D 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 27 extra unsigned-long words of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski --- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index d90f8f80be8e..11f9a44f4361 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -211,7 +211,7 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask status =3D read_buf[0] + (read_buf[1] << 8); =20 *bits =3D 0; - for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATU= S) { + for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { if (test_bit(gpio_nr - ADM1266_GPIO_NR, &status)) set_bit(gpio_nr, bits); } --=20 2.53.0 From nobody Mon May 25 07:36:20 2026 Received: from mail-dl1-f54.google.com (mail-dl1-f54.google.com [74.125.82.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B164839B955 for ; Sat, 16 May 2026 23:18:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973539; cv=none; b=k8fCV5HsuoQXl0X76pIfN6ryo7wqEFf7nObnbvu8a/2s7V1Y0XFbmgAvUfnt/juQQ2Y5pex43tWhmR5HnIRF6IKyVt7FTNbCnPURes0Awi09HCRr5fP9R0I3PZJkP/9hILDepl+iez7MdJX2X4R5oG3s0lkOB3VRNGVJUobmjQU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973539; c=relaxed/simple; bh=RfhWyhkILQ9JdmZHbT+RrfNjTCyKMG4R356hSwJe3G8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=p4FYzE1p36AyvMPgQmHo/tj9edPLhNFY/Bg5GlrrG80C9esMlF3vqriVwvEgqzxBxiqmwyEwA3kQOkGhFrLKMwcFcfI0FpcaSFCU/zuCfy5ti4QelGpHP66KRDvqA8fmrDk5sty4S4tKrT2Fwwe+9ZCPGi7OTnycBqhuEleQMU8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=NgB2h3mR; arc=none smtp.client-ip=74.125.82.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="NgB2h3mR" Received: by mail-dl1-f54.google.com with SMTP id a92af1059eb24-12c19d23b19so1373642c88.0 for ; Sat, 16 May 2026 16:18:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778973537; x=1779578337; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=oAd95b7/1qRCPRUMfS/TXEKMP5bhCN7d3v6gwbzEek0=; b=NgB2h3mRZZWHVoyEJ8oRUwKl3uRT00zJcYf/Wrm9kp518nqyeOdKrZycL6qx7AJZlN nBuvMZ7kIuV65ReiVxsNPBih81NgO30TM3ZoNTwVB8nl/zKzK7KOQYfFYJVrlXpYzmD5 vtxwx06t5xysf1BySfcxAQuIku28yGDSvmSZsXsJfsOx2wVqugRLJ7V5TbdQ8o80lZk9 ONRz9VxjhM2Gxs+T+1KP88L2eg82LyNbOU9rQo3KULZNR4JXWJaC4xjdTm4ezyTKLrXL e6N9I+CZAw3HpAE5YZKPh9Iiq2XGJaoFtju95CaSIdJrMr36vk3iw55vt39MnE1IMsDn iZZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778973537; x=1779578337; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=oAd95b7/1qRCPRUMfS/TXEKMP5bhCN7d3v6gwbzEek0=; b=An2raVDYkrt1HPiwS6lW+FZ580XZd/7hChLw19X3mDann3BMIagqVoUS8Ojg2vzj5d oTCfezbyk2K0PY2GLPyqzO7+UpWAIuCSrV2Lnoqlp8w8G93R2FcusAF1By55QVhpHk46 ZpW1uwEXlVI43ABrbzQsQXm32Jd/dQic9epCKDXOnyqSXOqIpfh7EKBTFbfaLPmmKL+r dXTmcUZM6GIqxda+V6wD+1cYTVFWpbOCR+64VGOVB09S2rxWCwPQXQzF3UqNHApfFikV gTNURXFFRvutcFygvQaRCPeyf/B6F7OTxGciKmmNT5rN68au3hUOe0FER+xKEF5Ij+Uy BylQ== X-Forwarded-Encrypted: i=1; AFNElJ8nq3sY6NKQQNH64ZnLKC0Q4ilM6WShqwAy+BhKsKUJCVMG5YQNT6RnfYz5Mp6ld7KZbyM/pJ4huOxLKoY=@vger.kernel.org X-Gm-Message-State: AOJu0YxUwo+LhUnbMHzJOARGVJwXUkrtzxbKYzG1hwl/DtegZiy+jnhl MdP19LoQd59kJ7QX3EUyZlYLT4+0Q1tV/CYzH9+Lh5nTp/vlkZ53cL4CxrCAM8kDxoA= X-Gm-Gg: Acq92OFsh6ugEjvRxF45oS8HjJPNBgC1uF0AzCLnaLomxw4O5x5sKEueQuP9ev9YQMQ oA9+QAoWhaGBWYprT83fTPfkX7hEJQyCCo7BB3m/wM0A4klvMOibL9CiDH+XjnHnePNNxgeEhYX sc4nzsJanz/U/IrCr5GPFAYVPBBX/nU7tbqqZL2St6PU7QT+5Tudv4Jbb0pH/rDoZBL7X07Qbem amV8eZwi/8oLyngQhaFJl2w7srbsfRUXQUH8KKl1L7BFVqVmH9bBwXcfDnQQxY1rDxyF/h5yILg DsvolsZpUKVsIeuE+JRnF/mSMchKYUK9G3LBEwBzpHUotiVFHgIHzAHYuswObzjue5xWUN74jug ECxgwKqpEx5htMI7B9kB3gDaI6dIDiFnR0oo2cBuP2YfOhq66azkRikG1BxDSLNBQTOIez9MfCK fQdHj/K0REZkXuhhctBhKzpvQOCJiXbXhJbYCC X-Received: by 2002:a05:7022:e06:b0:132:f27:5302 with SMTP id a92af1059eb24-1350440d03bmr4186170c88.3.1778973536840; Sat, 16 May 2026 16:18:56 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb9ef5sm14722254c88.2.2026.05.16.16.18.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 16 May 2026 16:18:56 -0700 (PDT) From: Abdurrahman Hussain Date: Sat, 16 May 2026 16:18:48 -0700 Subject: [PATCH v2 2/5] hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260516-adm1266-gpio-fixes-v2-2-801f13debcb2@nexthop.ai> References: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> In-Reply-To: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778973534; l=1492; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=RfhWyhkILQ9JdmZHbT+RrfNjTCyKMG4R356hSwJe3G8=; b=SRT6QNrMcC6JVdOXSE5bR5Pt/QkIyNsl4uxKqVxOGrqHqTKpw0GLITxsugccdGLhsMTCUu6Qd r/PkU5ndk+lBlRQLQPOLVgS4TsIj0wGu8s0mDgsqhiBAcdzS/+4IiP4 X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get_multiple() zeroes *bits before the GPIO_STATUS loop and then a second time before the PDIO_STATUS loop: *bits =3D 0; for_each_set_bit(gpio_nr, mask, ADM1266_GPIO_NR) { ... set_bit(gpio_nr, bits); } ret =3D i2c_smbus_read_block_data(data->client, ADM1266_PDIO_STATUS, ...); ... *bits =3D 0; for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { ... set_bit(gpio_nr, bits); } The second *bits =3D 0 throws away every GPIO bit the first loop just populated, so callers asking for any combination of GPIO and PDIO pins always see the GPIO portion of the returned bits as zero. Drop the redundant second assignment so both halves of the result survive. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski --- drivers/hwmon/pmbus/adm1266.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 11f9a44f4361..4dd67c02b412 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -210,7 +210,6 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask =20 status =3D read_buf[0] + (read_buf[1] << 8); =20 - *bits =3D 0; for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { if (test_bit(gpio_nr - ADM1266_GPIO_NR, &status)) set_bit(gpio_nr, bits); --=20 2.53.0 From nobody Mon May 25 07:36:20 2026 Received: from mail-dl1-f49.google.com (mail-dl1-f49.google.com [74.125.82.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8106039E16B for ; Sat, 16 May 2026 23:18:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973540; cv=none; b=Nonf6k/PyTf5slJHpLj7HdkeGHEYBR9IomX/sv5T49pLFAjzl97I5SklWMryzLTl1f2li4eKKKy0x4Xa/fUObMxwmAhtmaZFcw5rphQLHIgLh6ybjonX1c3p5jWDDlSkgjGEPM+hNS9/YQlF1hjDbrYTT754iXzxlJYMLo+DW5s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973540; c=relaxed/simple; bh=N23J27IfJVGe7SPQQt1S3jRHCJD8YogYhTzhMnkG0uE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=aYFharCr8rpUU8zuFnnUEzYQatmCuiXnQ41+NJWBhzW3/K8XNQJdmw6QAswkPkpUSuvYdIl6WXU/TNT4csXjojf+sPC5fqw9xMGgT0aly3+PQ4Qi9sEIRr8fM8bFW+mtS6OF25WXvkewTErABvqYFRfcZBtGF/zjm83ro1yFakA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=TKiimgkS; arc=none smtp.client-ip=74.125.82.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="TKiimgkS" Received: by mail-dl1-f49.google.com with SMTP id a92af1059eb24-12c88e5f4aeso460691c88.0 for ; Sat, 16 May 2026 16:18:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778973538; x=1779578338; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=dA2Xn0JnUjF9oxy4I1Ocf3rxy01MmF3T7GcfHEypX4c=; b=TKiimgkSAL9g5bijz9kfouf72dVsWGjjga+8jKXZTK7hJuSTq7h8j7fLR65+G3qvhv QVwCvVMVE4RYBXDYnaNOGiLOCwU/orzmrnwXgcZqpYBjMF6V95ESjEZJKsufgFv5IHTH bWfEjMU/nYdwDcju3NYgugt6yRkjdum6KVnBhlFGygXxtHPa8x6eQBvmchL1Dn5g/xE2 b5L677/E9r3MAc6IGCnsAFhf7s+iMft/MTxr57/BRQ2XirBJj5kQjQ0DQ52COHRvB6Zc f1kRTNOseNX5G9jLXsaqQultJqYh8o1Jjz1aXqRpgSvbtp/yrtki8Db6JsRAs2deqBvi UZTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778973538; x=1779578338; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=dA2Xn0JnUjF9oxy4I1Ocf3rxy01MmF3T7GcfHEypX4c=; b=sf9BxeuAVQY+1eyjMjKBhOdrdZw26lc+l1ewg8H4mAOdbCC0M5zxR7pMnmPl+0fok6 BMc43qa457KKrZZL2dgKogVxqOYXzYvk0Wm0FcpgBNh1nnj+fTJHezflJIbNPP0cgHyV II3ePeJG9dvCvyLPUqwGA7D4U/9NdkCZQTh7cfYRbsI5IujxozxJUWfAvTYAxCDjBOx5 9blQAT6xUHYrVox/VvoS27vFkNjSX6Kpth5q0I5cHqzSS06iDpK5FbKRqjLHPGVhmNfE mwFPWEez0s9gTZzn7jKlTdtWcPh+e+FycZdgovTdvF+vka/BtkV7LrdnefE2PNt8CrHN nXSQ== X-Forwarded-Encrypted: i=1; AFNElJ9DAt/45DAQVZNsnGdLMMCa7shXIWtIGAlC0w+K9ZCgxFwdjM/k9fxtoXJj8pGRQ/4ULQOWTlC/RbDMljY=@vger.kernel.org X-Gm-Message-State: AOJu0YxDNwpDQ1RglDXz10znNLvgZIpc/CqPpmaE4xHfssB/tn6VpqaR DM13GpsBeB+Jen0FnzemIQq9aUAn66u8z4fsP+8+j/tANHPBgl51Zs4LTHLcHYioQPo= X-Gm-Gg: Acq92OHflBFUFe/UB/Evf8gTjXLPI6X0BdPbt1mttnraUqglqxE99cTjHyR8VHA6asf M5kPZbeCzUTf/a1i+VqDMx5Wzwr7cRoKeoPynW10K67+0PgXCM1atUreRGEFYmjt9zd3XWt/B5t Tq9FMeeBjQHaOc9MbPJw37hpa4AzKLPdBfEDv3JKs+skWlW+107i11Nb0bUq+Cs2rOTjIcE98RE Kz+6KpwSmQH3UCqGbb18lhA3RjxQ9CMDnhJEHAhCI+dREGvsKPzl/6tOzBw7lwMjy5Grbr9NWYR 1jAz6E0LKp0Gc/HB6wug/2LoJYDAdVS8L9QiHLd9+SpLLn7GUPKpWj2XMh7gnDoMENDjzd3U9NE yCvE41tuv9MEpJ66iRp9DhDxdVhg4h17anmZfL2LCCXrm82Z6MMbV01yXoX7S6Sg5clt+jwfqm1 e8NV4xqEBt5guds593rz5mQFL/MR2XvxurmUHM X-Received: by 2002:a05:7022:f96:b0:12c:9037:5115 with SMTP id a92af1059eb24-134ffe9529bmr3676098c88.13.1778973537611; Sat, 16 May 2026 16:18:57 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb9ef5sm14722254c88.2.2026.05.16.16.18.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 16 May 2026 16:18:57 -0700 (PDT) From: Abdurrahman Hussain Date: Sat, 16 May 2026 16:18:49 -0700 Subject: [PATCH v2 3/5] hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260516-adm1266-gpio-fixes-v2-3-801f13debcb2@nexthop.ai> References: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> In-Reply-To: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778973534; l=2321; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=N23J27IfJVGe7SPQQt1S3jRHCJD8YogYhTzhMnkG0uE=; b=XrOwSRfWwG+q0SuALxjvhTMWsm+OP1kNQlIn0Z46oqN7219YpmYw7z+gUT4oTOENMEBlSyuQv Syirv9rW4wWBz9/Z9npoptY/vyCDDNp1+tsx75VEVuEyHPX4hV0gOhx X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the pin-status word as pins_status =3D read_buf[0] + (read_buf[1] << 8); right after i2c_smbus_read_block_data(), guarding only against an error return. A well-behaved device returns 2 bytes for GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or 1-byte response too. If the device returns 0 bytes, both read_buf slots are uninitialized stack memory; if it returns 1 byte, read_buf[1] is. The composed value then flows through set_bit() into the caller's *bits in adm1266_gpio_get_multiple(), or into the return value of adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls). That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response. Add the missing length check to both call sites and surface a short response as -EIO. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski --- drivers/hwmon/pmbus/adm1266.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 4dd67c02b412..57cb7d302cdd 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -175,6 +175,8 @@ static int adm1266_gpio_get(struct gpio_chip *chip, uns= igned int offset) ret =3D i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); if (ret < 0) return ret; + if (ret < 2) + return -EIO; =20 pins_status =3D read_buf[0] + (read_buf[1] << 8); if (offset < ADM1266_GPIO_NR) @@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask ret =3D i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read= _buf); if (ret < 0) return ret; + if (ret < 2) + return -EIO; =20 status =3D read_buf[0] + (read_buf[1] << 8); =20 @@ -207,6 +211,8 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask ret =3D i2c_smbus_read_block_data(data->client, ADM1266_PDIO_STATUS, read= _buf); if (ret < 0) return ret; + if (ret < 2) + return -EIO; =20 status =3D read_buf[0] + (read_buf[1] << 8); =20 --=20 2.53.0 From nobody Mon May 25 07:36:20 2026 Received: from mail-dl1-f53.google.com (mail-dl1-f53.google.com [74.125.82.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5CCD83A1695 for ; Sat, 16 May 2026 23:18:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973541; cv=none; b=Zg+Fy4lpA61E9hXA3udR8EG45ZBkxUmeadkwAhO/PpwLqxw4GL/6Pp7lCl2vSUDU2j2ThdEoRDyltLcaw69MyfxCHdzsyDvJ7+tXUwCRFrO8zwX1zIbvarPRwAtnmtoERIYYOz20NvbdxS0EWs5X3NeqkuWE9dEHPuCg/lA5oFw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973541; c=relaxed/simple; bh=yxjAXeOD8vgYHpYNi2nRb2U8lGvMYDcyt4MCoMgxNz8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=uKfp3sDoXDZX0c8VE5zAuDIdhiKa0RUnBOzDKp6oVhbe12191HFOx5ik8jkyjl17ggCu7X3orDTm95h2cxRzfOvLT+KdGZzuG4h4hT60/ChGWPGvboLpRPK/ftY3CRIgnNalBz5gFrg//3t/YRvcELXFI952aw6oX9Bi6cE9d9g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=XGRWecXk; arc=none smtp.client-ip=74.125.82.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="XGRWecXk" Received: by mail-dl1-f53.google.com with SMTP id a92af1059eb24-12c1a170a50so1171998c88.0 for ; Sat, 16 May 2026 16:18:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778973538; x=1779578338; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=jUnfFsool58oW+sRC5tpMK9MOqrwqv2manCcCe6X7bw=; b=XGRWecXkhtobTKZQlG46zaZAm34o3C9AA9gVr2yB0uDviFi4xxbnHQtsTFstT6xMi6 YSnH2wTfJBT7cwFQaggRfl9RFopXStbHXByPoNN3A6pedzqzHfdKAryxcnCJZewe4A+X FtcVCQNVPXdYeIAWLM0MqKWaPGziopTZjIn1qaiU/gJrGr1iQrXOrd2luXzZ2PKs7UhE Lbcs2Y2FAF4VX3RVSHU5/0WQ2a+8nI+QDMs+kPRRWfaRCaQ9OPH8HD17iZamCP4Ft/Lu KHNgSzUC2fHSt53LNwqjNEsWXxbm+ySEzW7+imWPTTUdHjrQdUN5Ozl0b1M06DIEcAQR MV3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778973538; x=1779578338; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=jUnfFsool58oW+sRC5tpMK9MOqrwqv2manCcCe6X7bw=; b=JyktqSCbyUbZ5rNU32VHT7OKmd53tt3b/gVyQgEiEn+XGvKVMf6+stCZLV+jk0DNL9 SvVeHjfYL9eaBugUwIs2EbocGkIWGcp8irUQGWywkNDhuIXiS2Hhlv/xavgfkOP69Fuu jnKBe2P6rYnnizlfpvDvKSY/ZMnUp+l8YmIjplgi7f3XC472zKR1rRuxncP5w0ohnAKG MG+o2/Y6Rzi7jOYh6jgAuZZtaYu7wqTCMiVJLMCeOrdHbWb9IvCyH6s42gmMBN5R5KIi HqwE1sXEnHzpP8LnrgmvCTMsit2vzyZ3mbyRLQ4ELVL3J6QP/5Gk3u/yyCeTVqmH8Xaw MyEQ== X-Forwarded-Encrypted: i=1; AFNElJ8MWXiqn2/9qxnyQEC+S2U8/quAJZFngKfejMYsRTqTMJUMHjWyxdOTRTM4lxj1Q9C8/yMqOBER9kFY7AM=@vger.kernel.org X-Gm-Message-State: AOJu0YyqBhJ9rxvaVpe2G9mCEuiCvqGGYKQo8qKVUoxoTD1jw6X/rhyf /v2KzppEXfI2LXiOIKsLoImhkxMlGjHG89C4waGnON6azK/Zmect5qkLiokfJ11cR2Y= X-Gm-Gg: Acq92OELFsEaEx/1v9K0K/mWUGO3JXuDPUYS54UQTb4UqBJSlmMPiJwyQ9ZFnYTuXrL 4bxh8aEOwG52BZnTKJrV5swZyjSqdE+86CHSBHW7HJSgLD4nTumwZ7xOpqShN4noL+F9rDzcK1j QzyCQxI0M5BTVPmOS+LtnviKm+LIrB7D3Ln6CSUc1F9/x9tOYRN6ueMbN6/MhXsJ0jE7jVUv7fy fSTcM83c7coVZYUTjZCQCBb25KAGm4mXxCqL37qi03Bh7MI7yY0pXLXUf9Y6Tk/CvAGkfUBkepy NII0O1PUHZfIs/tSmVqp4ciEGKz2Nm3vQQNa9I13QK6JJAmlRH+RYcxozltztFTtYugoI40fPl0 TW9cFW2jT0QhDdrpZ9eVZ5l/O1CCKFTyJo2U2+63mR72ObI6McdYZB+Nv1KcVc3ua4Lz+4OPKEe aq50KK8avXIeqrsY+hw1vDKOp9lXuGWRqlXewc X-Received: by 2002:a05:7022:6621:b0:134:a710:d908 with SMTP id a92af1059eb24-1350451887emr3707639c88.13.1778973538361; Sat, 16 May 2026 16:18:58 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb9ef5sm14722254c88.2.2026.05.16.16.18.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 16 May 2026 16:18:58 -0700 (PDT) From: Abdurrahman Hussain Date: Sat, 16 May 2026 16:18:50 -0700 Subject: [PATCH v2 4/5] hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260516-adm1266-gpio-fixes-v2-4-801f13debcb2@nexthop.ai> References: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> In-Reply-To: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778973534; l=1739; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=yxjAXeOD8vgYHpYNi2nRb2U8lGvMYDcyt4MCoMgxNz8=; b=WTiOWdWghEIO6M71PDijdRA0E0SWlC77JtKTutsFSXf2+p8yo3CIbVwylMBta2u5GORRt7VpR WfxCxYPFXsSAF4CAqveVJLuBo0aBnPgglLTy0Y4rYcbslUwj/KD/i+d X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_probe() calls adm1266_config_gpio() -- which goes on to devm_gpiochip_add_data() and exposes the gpio_chip callbacks to gpiolib -- before pmbus_do_probe() has initialised the per-client PMBus state (notably the pmbus_lock mutex the core hands out via pmbus_get_data()). That ordering is already a latent hazard: any GPIO access that lands between adm1266_config_gpio() and the end of pmbus_do_probe() (for example a sysfs read from a user space agent that opens the gpiochip the instant gpiolib advertises it) races pmbus_do_probe()'s own device accesses with no serialisation. Move adm1266_config_gpio() down past pmbus_do_probe() so the chip isn't reachable from userspace until the PMBus state it depends on is fully initialised. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski --- drivers/hwmon/pmbus/adm1266.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 57cb7d302cdd..b91dcf067fa6 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -467,10 +467,6 @@ static int adm1266_probe(struct i2c_client *client) crc8_populate_msb(pmbus_crc_table, 0x7); mutex_init(&data->buf_mutex); =20 - ret =3D adm1266_config_gpio(data); - if (ret < 0) - return ret; - ret =3D adm1266_set_rtc(data); if (ret < 0) return ret; @@ -483,6 +479,10 @@ static int adm1266_probe(struct i2c_client *client) if (ret) return ret; =20 + ret =3D adm1266_config_gpio(data); + if (ret < 0) + return ret; + adm1266_init_debugfs(data); =20 return 0; --=20 2.53.0 From nobody Mon May 25 07:36:20 2026 Received: from mail-dl1-f44.google.com (mail-dl1-f44.google.com [74.125.82.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D7CB3A3E66 for ; Sat, 16 May 2026 23:18:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973541; cv=none; b=JKssECHvpiwL/zeJXJ8OD1vVoGDw89Vq5gerB83EfLClyCzfufzDxHm2d/Qxelgys50bYIEuAy0MFjNPuVJn7rJkoX74PVyNmdKp1E/hkj6jyVUgCTHsPnU59Rqeum5b8UFlPZ6Stwu6jC2X7d8pJKDwKK9ngI/885k5EvSug6o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778973541; c=relaxed/simple; bh=YW/rtn93ECVx6D7M6zDzFzA7o/ZhLBNsrM1gBF6+BOQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=MUiO0wvhZwKKEH4u3sHmN4DjHUzRZfNqM+kmBQyeWjS5U/28SpKJrL/umGtTxtoXJAIL2nRhAY97TqXuPTjUuN7J0Ws3j6wY8TCTCbgl67rXe20WeWjYkx3BS/PxDiMvRa/HuVk3k/MDq2vJfJEFF2KPwbWRCjldA2TGfGw6AT8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=gYWz9Lln; arc=none smtp.client-ip=74.125.82.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="gYWz9Lln" Received: by mail-dl1-f44.google.com with SMTP id a92af1059eb24-1331e851faaso437600c88.1 for ; Sat, 16 May 2026 16:18:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778973539; x=1779578339; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=hOf0WuzHhr8GvHCx/Z0rI+KnB+Uz0CaABNA+3XjE3+k=; b=gYWz9LlnNCPPb9j3hzqdI0LtvJHgn4CtftQPz64NQVDC81+lu6FW/CMdKkgfKCN6lt Mwcs7mEqPlfkWooNM55QnYdgzhPeaPaup937Ap8nkisqgiI6X6/X30qUsLjKiTHAnuhC TXIn/krXg0vhf+wqtXewyiFc2AtHkhyIbU0NcwPULRe+wZ+jEAHeRxeywano7nQCwb6M qk1pI5eV1FJJXr8dDIKxh3sXKqqx4lDNMvSVWpmndSGUD/UuEvXG27kgrnLpy/n7otQA gzFhSQ2ttEPa3iEMutecomO7qroeKJ6VHoVX24Bwz4r7vSSkpkd9J1LV6q+C5ks1rVrU Pwxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778973539; x=1779578339; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=hOf0WuzHhr8GvHCx/Z0rI+KnB+Uz0CaABNA+3XjE3+k=; b=lUjwjxALyFrzmo4kUpZmxEMd3NVNb6k+AYpcuQSgvdTv3jJw2p5KjcnY0mprPCvuTX lbeLFQUyM7/x/GapE/M7bKyhdUhloKP4DArVIUdTlY+kauwOIgsl/v6ViZq8nqnvbOwC dGpuf1KZHqZcM7C/CfF2N6BPQPLVu5l9EdpKdCZWv7daHinlQbFRv4D9gQjv6Ert/6xB zaaQhfD0yKuutaMtSD/QnT32m6SfMMMbfGwMXbAQFhRxyoU5Ef3BnElBDgk1tphn7NKH EVqF/2RnWfCAWOI98jyfYbPXWIeS9T0RnKQ5j7DMrNcClel/u7XSTE0Tig5u8j6/kS1N Gb0g== X-Forwarded-Encrypted: i=1; AFNElJ+oJDaMLaRK0HjnV0u7+dGbxLJWlgS4UoBqywyybGzTIh+H82jz8fGs2J5H1qOkKWc22xIL35mysPlGXqs=@vger.kernel.org X-Gm-Message-State: AOJu0YwAAkC2BTre4ZVRTX06Td1G4r6VSSCWihWdJ7Fn+s8y0uaXuo4r i1LIrItZnKHdcfS2/x7yPmvehuOQgTk3nlFurZO5EpMSj2Cty15Qk18DxAh58SomcaI= X-Gm-Gg: Acq92OF6kfjReHiiqNWN2jKYfbXMawrR6fCTwTtzVVjxkh93vJyGU99LbePmyJqUOEO C0+tkwh/7d/jY1ESWOVAzwZdpldxsZ7/LKFeO93fzzNnfOOwPYjg3HXxQJaRswt5tjSA39rWVMD 7oUc2pN8ezlWcp977UWe6YsrBiqtYbJqCXFT2ZrU/u0lEoH1ZNcdqhqaaaI1bU8jCKFFSJKBTe9 dpLLIM4qUagfhCJxJrwwaAXduJFtwoGekNRSOmCGqizKW5qpCJV1+bsw0iaKRDhjV4BVew68MkN C4ko1bWIfKM2rSpp/9sfFIIP5TiVll0IfXUm9dIocMqkJnrq/fZi8ni8D7Ve1s+lS2p1/Vtz2ZE pDiJRxkCKmtE/vr9m0r+iWYeBhKe9QCPudCEOXondfxa0hJfbmUy5maPekfZQxXVhmB6K+4/aMM EXGovXC6IwOl6uLIl3ZToh67nRcIVJgmqINBDk X-Received: by 2002:a05:7022:301:b0:12a:6d05:3938 with SMTP id a92af1059eb24-134ffc6a83fmr4319683c88.7.1778973539141; Sat, 16 May 2026 16:18:59 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb9ef5sm14722254c88.2.2026.05.16.16.18.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 16 May 2026 16:18:58 -0700 (PDT) From: Abdurrahman Hussain Date: Sat, 16 May 2026 16:18:51 -0700 Subject: [PATCH v2 5/5] hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260516-adm1266-gpio-fixes-v2-5-801f13debcb2@nexthop.ai> References: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> In-Reply-To: <20260516-adm1266-gpio-fixes-v2-0-801f13debcb2@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778973534; l=2051; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=YW/rtn93ECVx6D7M6zDzFzA7o/ZhLBNsrM1gBF6+BOQ=; b=rLK3xSF67bYw9vOeeVD20baFsgJe0KchisiXDbpwdnxaQaYe62yO+8pWC8Y9C0GL1xbsofPfP QokCUjbGOa1ANdxf9Jmh9I0Uw2CSuGE2CeVjGT1O0Tx0ojG+lQxhi2p X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get(), adm1266_gpio_get_multiple(), and adm1266_gpio_dbg_show() all issue PMBus reads against the device but none of them take pmbus_lock. The pmbus_core framework holds pmbus_lock around its own multi-transaction sequences (notably the "set PAGE, then read paged register" pattern used by hwmon attributes), so an unlocked GPIO accessor can land between a PAGE write and the subsequent paged read in another thread and corrupt either side's view of the device state machine. Take pmbus_lock at the top of each of the three accessors via the scope-based guard(). The lock is uncontended in the common case and adds only a single mutex round-trip per call. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski --- drivers/hwmon/pmbus/adm1266.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index b91dcf067fa6..2e9ae03ab64b 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -172,6 +172,8 @@ static int adm1266_gpio_get(struct gpio_chip *chip, uns= igned int offset) else pmbus_cmd =3D ADM1266_PDIO_STATUS; =20 + guard(pmbus_lock)(data->client); + ret =3D i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); if (ret < 0) return ret; @@ -194,6 +196,8 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask unsigned int gpio_nr; int ret; =20 + guard(pmbus_lock)(data->client); + ret =3D i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read= _buf); if (ret < 0) return ret; @@ -235,6 +239,8 @@ static void adm1266_gpio_dbg_show(struct seq_file *s, s= truct gpio_chip *chip) int ret; int i; =20 + guard(pmbus_lock)(data->client); + for (i =3D 0; i < ADM1266_GPIO_NR; i++) { write_cmd =3D adm1266_gpio_mapping[i][1]; ret =3D adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cm= d, read_buf); --=20 2.53.0