From nobody Mon May 25 04:35:58 2026 Received: from mail-dl1-f52.google.com (mail-dl1-f52.google.com [74.125.82.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 834672580D7 for ; Tue, 19 May 2026 00:52:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151953; cv=none; b=CT2vIM5jjQTKIlSYlJuHxE55Cy4AAUOxDHCauhbWAnKRVsbLI7ouENgDAQfEm2CG9Q0hSVsZrG5ey7F2J3B1CkuzaTHE5vosFFVM7eLZVR0fBz5zstbJrxpDNMzFz2GzLzlM11kfQfSDz/vvmywuzgF3OJl8atLt4qIzi20dOeQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151953; c=relaxed/simple; bh=UKwTxR23bo/8190Ma3oEAswzHLxiNKOJzcKPyM3XidY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=qWFdR61gLjLTxqbEh43MMWQSoVEgcLzP80qDUOEL/w+QzU2qDLIDhCoMBZEauMyKy1VY7r5oM7YUK4CGcHrdAw2UKu2PDJEE1zBdtuY24qBIJ2e7IcgcbvLFc4OmQeg2vz/7Wca1/rFOjM0kyFApexFfil/IGTtS2D3kJrJYo4s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=KDQrKJOq; arc=none smtp.client-ip=74.125.82.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="KDQrKJOq" Received: by mail-dl1-f52.google.com with SMTP id a92af1059eb24-132830d8281so11559003c88.1 for ; Mon, 18 May 2026 17:52:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1779151951; x=1779756751; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=ewneUiTeW4FFURX4JgSEmHD5g9yyYbAjzLEjC7sMhRw=; b=KDQrKJOqDWANIBBqazkc/7Tn+rqj42Ln0vZTvIf3QMUiswXR4TAbNW1YZ4rIJOIESv p3Tbw6e9tHRKbgfzvmXlMs9Vru6V1YY8vzVtSMd2AYE4PEBpeGgucIzSo43ZkMrVyQn+ C/z0/JSQTw3dWykRwUpqlhFEc4/CLEVGr+wXjj1Qg6a4bV52zonueb3Mhd5XIEOE7If4 IbkAnPyuEEn7ruNPQwcjd+jd86JipRALBX3Yxu3BWD3/siULZxHtddtKHkrP+Ss7R356 MXJj1dZHCrMh6luFHMFFhFGtBcYC1emEEOPfeC9cNMFo6/dA27qlpcgzSsmB3fcSb4w7 j0TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779151951; x=1779756751; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=ewneUiTeW4FFURX4JgSEmHD5g9yyYbAjzLEjC7sMhRw=; b=jrij+8qlmjLEYNvqduvWMHCf/3nJvWm/vweKliicF3v4jTYtC9mVTvj8ZHChLgYvbr FvnYBBgI4MM+Z6IAx/VN2h3N2AOWYBa2uc9LPgr0ygdC0vcvyghiL/nAFJVVNSxIp8ip JwmDtn50mVQaLIB9atFCWwTJVQXy40blxvjVXu481eghyvcXp3jS2tjrhBehCON5vMZr 4F+o6o2H+uZ92W9PpmQwhVpYBG1+GMejiqbxUucfclTaPfqpmJaLKSNeimiUDjSYVC2A wXchLPp1tHF0zAKWCb+ei+1Uhf6HSSK5leenA6h7NPMZkg0lTeqHxPaBVuwI9grwcuhR EOrA== X-Forwarded-Encrypted: i=1; AFNElJ+2QRNgIxspTrrW0uYBuWW3TUF84N/kDiiT3x1sKnnaWW7AgxwftClbg9s+bV4WsLS4Lbi2MpLovJhjiEc=@vger.kernel.org X-Gm-Message-State: AOJu0Yzyfk6fEmtw+ixrln/wYVKUUbs0wjE6E3x1M+nKgAcidqGGKXJx Gz+KaYlT0gr92CK03aETA7n4As2LXaFdQpCscDkbdcSTwTTyIFAkZDhCY1QzfDbph4I= X-Gm-Gg: Acq92OH2iSj+OYJfcUEUkCOC+/GAVKe9k1/RTPX9nqfFlwtj4dE2jh2sV5Mnt6Y68tB kZbz905WEa6/2t9Gl8zYUodpqOJcM5b96VMIsPP4KqpxI2FAaMId9c/6vbc4E8C+LZp3WZ7kVl0 fCPxZI6njPLAL7zG9+59nEVhUatisI3gO8zYCK/5h2Ji/xcF/PuwLBqgmqn4XxuTAFvXFmmlFmm TyBuMrb1CryXEBMYRBziy+jzNO9SWHvmbu8EugCPTWva1ugyExKbUcLA0LkC/uRN+Cogo72WJFI gNXQbg1Pq3eihzymHPiS2Exkq1afhCeJ4D7fe5bMlvHSs3pgW8a2S584U8N/wgsaC2aE5e0qSJ+ yuXUl7pS6a/poIf3foMlCbAif5tv35uP9h9F5lm5sUDggDzdFJNvVrmix+nzwbRTRWVmYxqC020 gd0mVGWqSsg7yDpdMzIKW+MWuCnw== X-Received: by 2002:a05:7022:4183:b0:132:1e01:8737 with SMTP id a92af1059eb24-1350542e5a3mr8640606c88.26.1779151950688; Mon, 18 May 2026 17:52:30 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb93f3sm22546633c88.3.2026.05.18.17.52.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 17:52:30 -0700 (PDT) From: Abdurrahman Hussain Date: Mon, 18 May 2026 17:52:25 -0700 Subject: [PATCH v3 1/8] hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260518-adm1266-gpio-fixes-v3-1-e425e4f88139@nexthop.ai> References: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> In-Reply-To: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain , Bartosz Golaszewski X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779151949; l=1909; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=UKwTxR23bo/8190Ma3oEAswzHLxiNKOJzcKPyM3XidY=; b=xMhWNO55f7uVRzwHl8EIoXja68oza75rFM5LQtWDh61+3xx1p6acSL1AwhpH5fIuFDmlUhGJr K1cQHsXlSqTCoTjX5iLRkRb3K+kf+lgwi4Bd8npwGK39ZvPlUm6AqK9 X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR =3D 25. gpiolib hands in a mask sized for gc.ngpio (=3D 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski Reviewed-by: Linus Walleij --- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index d90f8f80be8e..11f9a44f4361 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -211,7 +211,7 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask status =3D read_buf[0] + (read_buf[1] << 8); =20 *bits =3D 0; - for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATU= S) { + for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { if (test_bit(gpio_nr - ADM1266_GPIO_NR, &status)) set_bit(gpio_nr, bits); } --=20 2.53.0 From nobody Mon May 25 04:35:58 2026 Received: from mail-dl1-f53.google.com (mail-dl1-f53.google.com [74.125.82.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 72350273D9F for ; Tue, 19 May 2026 00:52:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151953; cv=none; b=p//9wUJSCP2jJJrIp73Ij6AMWk+/xXGxROK0QG0Stpw1AaJ2GW6vU882TETwTt0zsj5QNrL2VuAD9tKzOvnABJ4FEer7F8bAzIX0JRV0ckzh3YewBXvCkD+Im22gu7a0ZV1+r7ksfyR1/LQUCEq8f5SibQSjNJCqmfutLA6Cl7k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151953; c=relaxed/simple; bh=7oeVwKpqCxGqOnMbjsP+k2FBysBipybyK2sSj3BSta0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=tX8JyfJ6XK8MJcxZ2ZWQXmkcHCG+7RuXPIy8tZZi/Jfh3qdl7Sundp7QoO4ju9DuV1qfOQA24am55wNro0EDvWmo0qKd0azLEq5ZcLS9AnHnF2aTsswSCW6zkOSyu226oDjANM2lfUDb/Hr19hd5K9D8Hor3JWdCSCTg7un4DBs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=FQgGJ4kO; arc=none smtp.client-ip=74.125.82.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="FQgGJ4kO" Received: by mail-dl1-f53.google.com with SMTP id a92af1059eb24-1331e851faaso1492658c88.1 for ; Mon, 18 May 2026 17:52:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1779151951; x=1779756751; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=PonswPhkAzDBi/+Jp4z7N6H9Ghz98afuWr/1QrXWWfU=; b=FQgGJ4kO77jKY8q6xhwk6HsxZOwX3rJWBa3v+NJx4m0MrakbxCRAamMStUDjYYHjPe n7WXoMre5w7wxYSFx0pXDvph4r7/N62U7wgc7ydrtOwyj3dKHYtqaUa9mvq+KBJfv96L QLZg7Ny+gHyYI5qIghKkp6WuQMHYwbHwY5+a5Ry+nMte2caSB5834Rb8Y3czXspxEYJM KUxBW5RIqQsn/o3X49QfE0y6Ms+SV8hGSvkzu3Su8oVcp5PEzjpRsT1JfQf3npfXLxTF fSC6SBJB1JR+PeY8J6fjxB3CPMM9YFo+ilKuWlo3BXqpnhe/YXMobz3+3Bnv+95s4zkF Qp3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779151951; x=1779756751; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=PonswPhkAzDBi/+Jp4z7N6H9Ghz98afuWr/1QrXWWfU=; b=duUvtvZwIs8yo+WhK2sIdvpArHi3zT3AzZ1fNRXLwth0HoxgeH5BjVI0WJ5khy6Tu0 WC/+D0f3C5arL4j3NOEXciJ7xdIbmDvNAn90yTs6mKOAqAQoVySBsGCdSUbamy6uZ3p0 MZStEZ1VRnPjvt/vjj1qOB9cn0MhSQ1py/GigNdOvRKqmnzRPTblo1iH4QQ9XOmBZlDu 4kF4dfG42Xoat7WcR4oc3MQw4rvIxIAnoQ7rpmCapFnHdLfkYemrNDhqX4Y3Uaam5MVy EBWuNCBzckGrigYR9dJ9DvqulIZj705WBazQ/rhYqN3A5ozJURzmqd1Zp6S59ACTah5E 5pQg== X-Forwarded-Encrypted: i=1; AFNElJ+BdORTKPB/aBFs+SUieI82pW9mnTvrYa/Wkv7ohxuZ3DIkn3FrdiI1gx8Pr4iPgIiOKaJnCtWCkaotxYY=@vger.kernel.org X-Gm-Message-State: AOJu0YyxI3ezfbVnlbj2K2tcWBaRviLyvfnxVcXNZaN1odQSDfd7umn1 CoT5p3TWXiEUf57QSF7rX0MtbT/MGbHIKQWRajjacfBLmuQDHPTU1dZ4G2YhFhYBlF4= X-Gm-Gg: Acq92OHeDX+BB7Ka72sTZs1fPv4Hkak786sFPfulsAzLHVNRJhgW6Wh5856/ycFekt5 1P5fhQt2y2rn68VmEeibENeByhL3Z0BEW6wcCIH3NIBsScOXYjpvtXxLiJmCWe+5UzkaIV87n4t VFsYp5tM7ASA+2k32059oOKsY7PLCUqAB2rjXpVCpF5OEhZDpxbhjvq5U3Vuakwa3cgq/lKpfuz lB8zbQT5phaKgkbJ33uBgwNc1sYPPK7nD5iMUMrpJeLii+wwvSGP+8At7zQiH8pSQybs+dtMgu2 eglbzw7TMVy7QXGrSniSjDHnMOmQpC5XPG4f0TLeGBrlwRBoWHrZhgPtUvP07bpN8DG8/sgmSng uqEYJV/tl8y4kzoeo9HAA+E0JMVMb6sKCDVeB495JSWkXcQ9YllJvZ65i2QeChAsWcHPIa2Dp5o L1f1+ZwWThUg+ynHvSOaFnyQXobw== X-Received: by 2002:a05:7022:238f:b0:135:60db:3412 with SMTP id a92af1059eb24-13560db354bmr3638913c88.10.1779151951380; Mon, 18 May 2026 17:52:31 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb93f3sm22546633c88.3.2026.05.18.17.52.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 17:52:31 -0700 (PDT) From: Abdurrahman Hussain Date: Mon, 18 May 2026 17:52:26 -0700 Subject: [PATCH v3 2/8] hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260518-adm1266-gpio-fixes-v3-2-e425e4f88139@nexthop.ai> References: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> In-Reply-To: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain , Bartosz Golaszewski X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779151949; l=1613; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=7oeVwKpqCxGqOnMbjsP+k2FBysBipybyK2sSj3BSta0=; b=xDW5l49mtttRT+LsIzPeEnV6ZnDcneJeKt08CuJu2RFwl+Iq9V4lOY6NCS2cJYZMS5TA1QJKL ALlOlTCDXjfAMwewAaxc+gY2de79j3fiY4570urPmwMWQqgOTr/ZOQs X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get_multiple() zeroes *bits before the GPIO_STATUS loop and then a second time before the PDIO_STATUS loop: *bits =3D 0; for_each_set_bit(gpio_nr, mask, ADM1266_GPIO_NR) { ... set_bit(gpio_nr, bits); } ret =3D i2c_smbus_read_block_data(data->client, ADM1266_PDIO_STATUS, ...); ... *bits =3D 0; for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { ... set_bit(gpio_nr, bits); } The second *bits =3D 0 throws away every GPIO bit the first loop just populated, so callers asking for any combination of GPIO and PDIO pins always see the GPIO portion of the returned bits as zero. Drop the redundant second assignment so both halves of the result survive. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski Reviewed-by: Linus Walleij --- drivers/hwmon/pmbus/adm1266.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 11f9a44f4361..4dd67c02b412 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -210,7 +210,6 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask =20 status =3D read_buf[0] + (read_buf[1] << 8); =20 - *bits =3D 0; for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { if (test_bit(gpio_nr - ADM1266_GPIO_NR, &status)) set_bit(gpio_nr, bits); --=20 2.53.0 From nobody Mon May 25 04:35:58 2026 Received: from mail-dl1-f49.google.com (mail-dl1-f49.google.com [74.125.82.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B24A27CCE0 for ; Tue, 19 May 2026 00:52:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151954; cv=none; b=L/IT+yXZpEcdFMfLDX876+wwJETgnCHiMSfrdoT2E1ZcVnUJsNA3Sm1uI4MwAQWQU7rWtkGpDbbO1tqBaeWMzm05au0VVe79IUXaRaYXzIIaa36RB41J99ZAKpVY+/0NzU8uZzIv1jalw6zmZ8psV0JNrLMFhxGjvzOGbnI6TUw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151954; c=relaxed/simple; bh=rSPUXzgLQKI1wwnUPptEwKPDreTpZONWfB9dTDbQyy8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=shK4KkLg/lDRBrymFWptyoJ77giFdN+86YgiZePhGW3YQxcRX3eOsXeelli/i/1kTinU63po0A3e81XQBnHykI/zomudW60qbzJxSQkmRP84cv6bRRh/zkJRUqV4mbVNuA8UjdlhoxbvMLQVk3GHdVn+IolNpK/ktNEazsFyg+I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=VWxg1iaI; arc=none smtp.client-ip=74.125.82.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="VWxg1iaI" Received: by mail-dl1-f49.google.com with SMTP id a92af1059eb24-132c338a537so2524646c88.0 for ; Mon, 18 May 2026 17:52:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1779151952; x=1779756752; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=xkSDV/hGDItXdWtxgXI29OZTMaQsdY9kIYFJD3n6x/c=; b=VWxg1iaIkmllm7/M3RQVrTAAgreJ7Od1e5XdYmpfcPojzc+9pf78AIX9wNB4viH3pB i7ntaBmNGjQq3nPBLvpIay2n6NbEwwEhp0SW2/DOxhPkQBN24ZfA9Uw/aQrrZzo3XDwt kBkcmEdy8U+Hat7WkZCZzAvDIkuFAWz9HKuq1zoX3T1yd0Ffz+s4iaaWKY0X2myde96m oNLnBhpCQkBWiB+MyFUP4Pcqaqits7QW3AH1G7ZowoBL09622c1aXMkgVggot7gZqN0O 4u7LfLr2PZtwh6Y9JHaOoNHCiRs39/JlvJOTqNM78OAdgqOaR/zMPd/gEonJNEswD7TL iGkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779151952; x=1779756752; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=xkSDV/hGDItXdWtxgXI29OZTMaQsdY9kIYFJD3n6x/c=; b=kfbA5edm/2eQE70/L3UXY984gsIylgTzKoUS/nDCLXzmjHEaQQf0PUdEpNrBH3qewn EQeYj9HQWjOG+Roy0P+ffzdYtolb/05NsHMRjnQoCZQW6xYNtyYcBuVL31WlOInRFUPg Pv2Y823oQezxlXZefs5zswlqYPBkfyiiVBFYD2+gtSxWynO3GR95gqxtMIKqmlNOPPB+ S2AHk1f7WsQPfilv/DpGfQLcYfNg3Xln/9uysdofz8vVJBQHiki5wVeNMXJi7rZh2eEj 7x7Bu3w2/byea4kWWjP/6o5sOLP9v5wstJs0VHw9O7VcHC2ZQk2yF4kmXRj1gUr+QQ3A 6+iw== X-Forwarded-Encrypted: i=1; AFNElJ9Km+yHCnhIJbfkDrbkDKsdUp+kfTCqgA1rWfhx28l7ZnyHpfG6SkmR/xRQFHlevy5+UJ+VrYxfGHJTFrI=@vger.kernel.org X-Gm-Message-State: AOJu0YyqZ+7m4boQRpKMi6xu96usPGwtJkXx0a1hOk/0YQcvAcMZ2x7s pJTz7zmScqjVxQAfx55KN0NB3woUM/vSb8GmIckHXNMLr/eDqhnzAX6sGChp2PzeDas= X-Gm-Gg: Acq92OEGPdUgRQM0WV4qfUJ/C0dPYM4P8vLuAgZKenOWM0JTQgpmdInNXcF3HSLUemO krwn/P1X4I1jAK+MRZDvOi7fK5nM45sHjRlRhj9AsAdPWl6EPMAkMLbzGqJ8fez6fTxG7UDvZQl ooHxAHYUQhYHo1Tc9BqQ9HqBae0jinKkSPzXwVB8m/jd+2XzSkcSbUkD+TncOEocsvH7/w5givd xg83FhwSNLKMmq5kzI5o3tnQJDxQFF+4DULeuCSV32EtubqFHHwsqmMNahYO6H3nwLbzz5GhHVO qpoIeTtfCdeBz+McER3im6rxwew3U4x+w1XGK3FmzFAr66dvDWQydiXnKRNc1Ig8/3DdB3ICQjo MMWp3qL92sS4qt7MuQm9e7YkVKmaJX1AbYJKmVKO0aAHB3xx+DibReQMewfWgrRA54NXCmrXzk7 tv0fljJb43AY6pDO/tw8fVNZQ5NA== X-Received: by 2002:a05:7022:250b:b0:12c:6dd8:623b with SMTP id a92af1059eb24-134ff500f38mr6567069c88.0.1779151952355; Mon, 18 May 2026 17:52:32 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb93f3sm22546633c88.3.2026.05.18.17.52.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 17:52:31 -0700 (PDT) From: Abdurrahman Hussain Date: Mon, 18 May 2026 17:52:27 -0700 Subject: [PATCH v3 3/8] hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260518-adm1266-gpio-fixes-v3-3-e425e4f88139@nexthop.ai> References: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> In-Reply-To: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain , Bartosz Golaszewski X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779151949; l=2394; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=rSPUXzgLQKI1wwnUPptEwKPDreTpZONWfB9dTDbQyy8=; b=K+8bHGXkf6oBwMcxqjzXElyXNeXhFer71lr5CRjozh8Jex49aLDFwWIl2SefX8JKqfza6NZJ8 n502WXx0f+KDep2/9UWQR4xrP0ALQwNNexLE2viY6t1it/tkxDIBXGA X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the pin-status word as pins_status =3D read_buf[0] + (read_buf[1] << 8); right after i2c_smbus_read_block_data(), guarding only against an error return. A well-behaved device returns 2 bytes for GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or 1-byte response too. If the device returns 0 bytes, both read_buf slots are uninitialized stack memory; if it returns 1 byte, read_buf[1] is. The composed value then flows through set_bit() into the caller's *bits in adm1266_gpio_get_multiple(), or into the return value of adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls). That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response. Add the missing length check to both call sites and surface a short response as -EIO. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski --- drivers/hwmon/pmbus/adm1266.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 4dd67c02b412..57cb7d302cdd 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -175,6 +175,8 @@ static int adm1266_gpio_get(struct gpio_chip *chip, uns= igned int offset) ret =3D i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); if (ret < 0) return ret; + if (ret < 2) + return -EIO; =20 pins_status =3D read_buf[0] + (read_buf[1] << 8); if (offset < ADM1266_GPIO_NR) @@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask ret =3D i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read= _buf); if (ret < 0) return ret; + if (ret < 2) + return -EIO; =20 status =3D read_buf[0] + (read_buf[1] << 8); =20 @@ -207,6 +211,8 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask ret =3D i2c_smbus_read_block_data(data->client, ADM1266_PDIO_STATUS, read= _buf); if (ret < 0) return ret; + if (ret < 2) + return -EIO; =20 status =3D read_buf[0] + (read_buf[1] << 8); =20 --=20 2.53.0 From nobody Mon May 25 04:35:58 2026 Received: from mail-dl1-f45.google.com (mail-dl1-f45.google.com [74.125.82.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 270052874E3 for ; Tue, 19 May 2026 00:52:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151955; cv=none; b=E9aErREOEluwdYyBiL+6d2CXIZxoKHdUr/ZrZI6jHKBjNuNQ9c03ONuhZubxRtdO1tuq4qVoHB4nT3l4o2rclParIUeC7j7JyADaoqglm1NZ2SvnYiGlrNjEpTB72vCCe1lV9zEycKJ7zn4Jp48w3x7Y0ybbjrqViEeTSQ9nQzQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151955; c=relaxed/simple; bh=1JG+/zkIS+GEXFeDqZ4D4F9Ctl/p/94MPO/ij8zaqjI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=KdrmEfuhyxbM7wybQpWqnCjTrqEKaa4KbKbYmqQDDytGlBBAnNagZcNER7nUnqbrpJO/QiDusAnCHqOW19VwiRvwztECDHgQIIif83h3PcImBHPO+3/fww6IxZxSx8ltiOgcmb+shXHBaL+AI2tdroZWKzUJ17NCpY2tNwFc0BE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=BHDlrNtW; arc=none smtp.client-ip=74.125.82.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="BHDlrNtW" Received: by mail-dl1-f45.google.com with SMTP id a92af1059eb24-1329fc4bf77so8076171c88.1 for ; Mon, 18 May 2026 17:52:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1779151953; x=1779756753; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=Zlzk3IweM6/T1gjXkni5pH832MnF1gtDJTKqsEsOXm8=; b=BHDlrNtWFcjsv4sNRVfNpmf2mpHdjuAbMov+K+YfBX8DJx5FKlJ2vVGbawleEYJInO nawHYFADCL48EgoxKTIaHrx9wAgtvmv44RswJDZED7VbfshZmj3Yal2vxSSthkaOIj4l bOpMGZJgCTFvHx7HrOZm+5LrIhxsPkRhSevzIfoLzmb5g3JUBJ4Q+z5XQzf9CULKoQff 4ZH0a63aVxaIwAUJOc/79XdjD/SzSAe2OIUMldil0Gx/iSKkqs+prrEnEFKpcrqRddMv +t+ceypaYPMDMqYJwb2pNLd+WQEMbArKxjGKQBzViBtkvQ640Rpe3hQixj+JZpCDR3U5 tOsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779151953; x=1779756753; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=Zlzk3IweM6/T1gjXkni5pH832MnF1gtDJTKqsEsOXm8=; b=DMSLPMwG1+Trjjlfhq3U+3v54UEYNKUAjBFDIkXUwPaFyX6KRaIZ0UROXVRe8dwwp4 0o85HWRCT6v1EJG5Psvd/diA55TKWp42WPDcJ27tFAuWPT957atOZDI9ei6lJYvil2LM LJSTm0LBQRcs5x6CfJdcv8TsHJYzkLkLUvznVtFjZGMNhJxpDwNz+xMeOEgoX7QJI7pz IGRIs2cu3wC8SeqgNHDdeeMKJEkiC/YhDSww5fm/lOWfWAdCh5MNzE9U0HVvFNQNCjAY 0fq8k3US6k3RKHdIA3QcRkwKsbo2mb48/lEFC+IqdKuIkRzmaLCapFYKC9LhVfSlCaDI jWkA== X-Forwarded-Encrypted: i=1; AFNElJ83KduAKPNX0IvSqMs1Xn/6ywM5IExLeETx+0k7hl4g9LN3aiTk02vMH/5QiDSrn2jwMliBHPYJ/cRRu1g=@vger.kernel.org X-Gm-Message-State: AOJu0Yz1Jsodg/Uk0jt6wYDwCvwkI5tirzUr1Yo3Qn4/uJPiVQbzpir4 tdIwzOH3VkYV/Jvii545QrmIwy+hV0UPHAgfh4GcVHd97Hy+tTKkqxwHES+cmlXzzXI= X-Gm-Gg: Acq92OGSlQTAeJ94iJIzOSbzpa1pxPL7JoC2kg2sy/gy3wbR1inQxfz3aD47BxluCMz MTcdnCOp6W8ZfzU0rHo4ySxvIQm/XxiA6F/v145oytxSd0ket5bWvoNq5tlETx0R27ofAd1DG8O cFF+xOOc0TvSmODBArzXMNSqq8PxyOWvE+5GxM/iITq1jgDzWpogA3QRXPv3dgyDEiKVp7w+K9j Y2LcclGGwI35VuGRoK5rEpKByVCsICPk6t+PgS7CEgQL8/y2SVSiQDtC7+3OPvi+tW8CQwNyW1H zejDBbKUF/BebdfkjoUvN14B8l9bQ1/az3jfVrxoFeurspQPMZ8LkNGo8n00Cr7A0CDUoo09nAm hg4jo+VVeubowGivkHzg6OYMlgXNy7SFCXW6rkTt5LBOlUmT78/wOGK23S7mk+XjHvpZQVN9aUn K2y5ImoIgO3GOBd8OdZ8S5FUN/9A== X-Received: by 2002:a05:7022:7a2:b0:12d:c9b6:bbdc with SMTP id a92af1059eb24-1350494e473mr8550867c88.30.1779151953289; Mon, 18 May 2026 17:52:33 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb93f3sm22546633c88.3.2026.05.18.17.52.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 17:52:32 -0700 (PDT) From: Abdurrahman Hussain Date: Mon, 18 May 2026 17:52:28 -0700 Subject: [PATCH v3 4/8] hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260518-adm1266-gpio-fixes-v3-4-e425e4f88139@nexthop.ai> References: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> In-Reply-To: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain , Bartosz Golaszewski X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779151949; l=1812; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=1JG+/zkIS+GEXFeDqZ4D4F9Ctl/p/94MPO/ij8zaqjI=; b=eDz6CtV+xk55DonqDrs1pNdpplss0Fqb6RErODkJAylZJrzDENIty2KbtoJC91N9SDjbi5UCS sbEujihg8YUC0+CRw+cQAghEQIkGIUQUkYd3V4fLbB9hMDwRxFEPzB2 X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_probe() calls adm1266_config_gpio() -- which goes on to devm_gpiochip_add_data() and exposes the gpio_chip callbacks to gpiolib -- before pmbus_do_probe() has initialised the per-client PMBus state (notably the pmbus_lock mutex the core hands out via pmbus_get_data()). That ordering is already a latent hazard: any GPIO access that lands between adm1266_config_gpio() and the end of pmbus_do_probe() (for example a sysfs read from a user space agent that opens the gpiochip the instant gpiolib advertises it) races pmbus_do_probe()'s own device accesses with no serialisation. Move adm1266_config_gpio() down past pmbus_do_probe() so the chip isn't reachable from userspace until the PMBus state it depends on is fully initialised. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski --- drivers/hwmon/pmbus/adm1266.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 57cb7d302cdd..b91dcf067fa6 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -467,10 +467,6 @@ static int adm1266_probe(struct i2c_client *client) crc8_populate_msb(pmbus_crc_table, 0x7); mutex_init(&data->buf_mutex); =20 - ret =3D adm1266_config_gpio(data); - if (ret < 0) - return ret; - ret =3D adm1266_set_rtc(data); if (ret < 0) return ret; @@ -483,6 +479,10 @@ static int adm1266_probe(struct i2c_client *client) if (ret) return ret; =20 + ret =3D adm1266_config_gpio(data); + if (ret < 0) + return ret; + adm1266_init_debugfs(data); =20 return 0; --=20 2.53.0 From nobody Mon May 25 04:35:58 2026 Received: from mail-dy1-f179.google.com (mail-dy1-f179.google.com [74.125.82.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 104072BD02A for ; Tue, 19 May 2026 00:52:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151958; cv=none; b=H79OCakDkYjGP1/h6RhshiZCl2roAeEBNU+zVsQAemJws/d/q2fL0gTYN5L05vA2OxwZQJpqwhysT1i11nke4hYQPtr0NAjQ+8n7FWRnu1EHwe0L1yD0vFe8GRd//d+DacnOu38bJXn0HDqTnH2U2cQtDpHNhNhUMVyru5+SxR8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151958; c=relaxed/simple; bh=iQxdf1yuFfxkq4dVmlhtA1OD3Mg8u9x0iWEOejR0KI0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ktJOXWqtEIcZDG3UaDh5xKCmnXNgyM1sZABUVXmPLC2ivULRDYH7LjWsUWrEsw8JXOSzlV9K1BIdh9v4OHCn2XzqiRzojq/fSDlPVRjnHuVKY14Y28r/xMATOAKOjH8mZ+Wn+dlgw0c/XdgrhKDKpJ5V+BtcSJT1j8DGEp72Lsk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=QoX5yKYw; arc=none smtp.client-ip=74.125.82.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="QoX5yKYw" Received: by mail-dy1-f179.google.com with SMTP id 5a478bee46e88-2f00a567cfaso2059654eec.0 for ; Mon, 18 May 2026 17:52:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1779151954; x=1779756754; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=y2P8AA+VKiT9we9opdJjInDAt+Givsn990e3P/EhFhw=; b=QoX5yKYw9dzTwxSdddXoeYY5y/bVNsZ0pGp6Lo0U6U0HNxtv+Qdz5AIftI6ji4eR1r 3M7kt4AcLBD/Q7RlXTR1Wvn4lBXM/U918fFrifzLlPjFusPZLHdo5uUDkUcbZdT2Ub2U 0LkuIlk/x2/RTsNPNYeTNuO/GxHMnY4lZHxE6DF0Y+LrkfVi/Gd+Q/pRVLzkL2Af4/6y aXkxL2h048IsfN65fCv7/k9q6VZB5CC4y8dg2UDnHjoqGGF7oHom+12jPkIVHbEVtSjr e7GWYORoFUflbUjAG0Iboi71j/cQWC7mK63roxpqYv/NxVKatksru6I1lkLlGIOj1ZOM h0LA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779151954; x=1779756754; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=y2P8AA+VKiT9we9opdJjInDAt+Givsn990e3P/EhFhw=; b=cORG6mTGaqHZpQFIb0ZoCi9ZnS11s5zQWjRfSBGsL5+i4subWztk0C7RG7+58jdXtx dugKHpnVTyh6ySdQ8Nwh2AP/MgUmLPjqTBkQAng55hPXSrB+phShtXSj23zK57nqPAmM VeZ//cSpOpWiVqfrGdo+DrEvmT3mc+aU05OzfKe6fMwRAlYClY5Dxpfwqwl/R1W0vv8u CFqYY53immQcZdfhsWsbPAkavHIByryufg9LQO8FWJv65VfOnoBU2cTS0NvCHcZowo7w e/5wuhFE5LgcQ6WhdBBBmfjxQ+i0YSjQPkFxn//shfYFANDo4QIZzVdBHsmPdtU/dS3l UEKg== X-Forwarded-Encrypted: i=1; AFNElJ+JTlQFUisHME4Wcga3XYMf1LDWeAcWBMoPkCk6vOuDMeKl9wKLZphUXFZyvph4Jjrpv2eeon+ns7hTBtk=@vger.kernel.org X-Gm-Message-State: AOJu0Yzrzbvg/GFnWPjD/EO2y+t8iT4Of+mCdvHg7CJMNfdNbs/ylezg Jq6ivpuGijVtkNttRbkP9R8tgokJeYiucdyW0KERnWfFEhoPqV+xoo1SZaDPvEUhcOA= X-Gm-Gg: Acq92OEkQu43xKPxB/cv1ZWUgRElxy7oGymd2TJ4hZaBHoW+5l5Lik1UZ/1tnvS1xzH 6IEShkAtRV+JglvywdzfEgLWNeMjCo/tfHfJEds7IBpUfN5nJPQ9ziQqaTHLAO4AErNtiV1kuaU CZa+YshJxt6gD983cPNoQmrIBwL5jLoRVP8P0idP53fSF7dtlwKkYgJ5tGxNGl/IbGfGTiPFtP4 vC26JeuzQxG/McS1v50sQEiHUb1e56zKLZw/1zjDc8DLhaGplbt8P5/6v1gC4MuK5nE8PMo9uur 2N18BHtG6jH90Qa1ie08OQUV6BaBrqA/vd+z4MX4dikx6yW8M5QrG4vRJHPaJjdL580t+njgYq4 vAyn12+y7IU+GTMnZG87Yc+fRd8NFQATsJEuPiUVcHdJWCFZlF+oCkjKQKmDt6goinpxWRflDrZ 4P1h5Rfqv1ybCALqmv4rZqLDoM4w== X-Received: by 2002:a05:7022:45a2:b0:12d:c3d8:1f95 with SMTP id a92af1059eb24-134c880b6bemr8010416c88.4.1779151954194; Mon, 18 May 2026 17:52:34 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb93f3sm22546633c88.3.2026.05.18.17.52.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 17:52:33 -0700 (PDT) From: Abdurrahman Hussain Date: Mon, 18 May 2026 17:52:29 -0700 Subject: [PATCH v3 5/8] hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260518-adm1266-gpio-fixes-v3-5-e425e4f88139@nexthop.ai> References: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> In-Reply-To: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779151949; l=1611; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=iQxdf1yuFfxkq4dVmlhtA1OD3Mg8u9x0iWEOejR0KI0=; b=TcrBIRWgrteBYTVwtpzSU+2Wm3eg5LmBx6FfTh0fYto/+XZGoCtTnc6S6Pu63qnTE8+oW3o5t lXy2qBOOeXWAvofdMd9M+EiP8hmV2QzMP4JS+jPrPk+hvk+oDWwCO9U X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_probe() calls adm1266_config_nvmem() -- which goes on to devm_nvmem_register() and exposes adm1266_nvmem_read() to userspace -- before pmbus_do_probe() has initialised the per-client PMBus state. Same latent hazard as the gpio_chip one fixed in the previous patch: once the nvmem device is registered, gpiolib's nvmem char-dev / sysfs interface is reachable, and any concurrent read triggers adm1266_nvmem_read() -> adm1266_nvmem_read_blackbox(), which issues PMBus traffic that races pmbus_do_probe()'s own device accesses with no serialisation. Move adm1266_config_nvmem() down past pmbus_do_probe() so the nvmem device isn't reachable from userspace until the PMBus state the nvmem accessors depend on is fully initialised. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain --- drivers/hwmon/pmbus/adm1266.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index b91dcf067fa6..8b9fbb99a4bd 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -471,14 +471,14 @@ static int adm1266_probe(struct i2c_client *client) if (ret < 0) return ret; =20 - ret =3D adm1266_config_nvmem(data); - if (ret < 0) - return ret; - ret =3D pmbus_do_probe(client, &data->info); if (ret) return ret; =20 + ret =3D adm1266_config_nvmem(data); + if (ret < 0) + return ret; + ret =3D adm1266_config_gpio(data); if (ret < 0) return ret; --=20 2.53.0 From nobody Mon May 25 04:35:58 2026 Received: from mail-dl1-f41.google.com (mail-dl1-f41.google.com [74.125.82.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 005B52DFF04 for ; Tue, 19 May 2026 00:52:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151958; cv=none; b=iSy3bpBCmaFeUqj7/Av2uQHJ3Du6xVJ2gGtlqjbKg24Ql60FYkIJ0VDQ+E9sa9K4Cbll4opJPJj0vNKnk/ytujrwJztsbPk71J1W6JXQ3+g/CYdqewTm/FZqxagR/aAmYMHg2YtWfjA6UcMRC9vEu9OgXRNGOUqH+sckyUl5hTw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151958; c=relaxed/simple; bh=kGAUxCtbDfmt+7K9n1CVIf/I9Exjw2mL1Khe/Uk924I=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=evCxNkAiFyQqb4n4ESDpl9vlyFWJG+QYvRBRYVKaS+P5dKhACVwdFN6FbClp57qd3212kPfZFrxOWA50EHB4wovamOVlmC7D9oHKNfxIbseEXZK/6TYRqVZnolXn0h5xHWv3c+uFXgvKlsPQSDBjJA8xdERREaacRzAHjkRwktU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=kWvDZK8o; arc=none smtp.client-ip=74.125.82.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="kWvDZK8o" Received: by mail-dl1-f41.google.com with SMTP id a92af1059eb24-1331e851faaso1492676c88.1 for ; Mon, 18 May 2026 17:52:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1779151955; x=1779756755; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=sYDly6dzMfBVk+bP7Sp71lgzYnskpjHG63z/xSSPQ2M=; b=kWvDZK8o10adgbx/UbTu/EBWNCyeZi/m4r/9Tomh0M1hP7u7esNQrv3MRtNUbmTXSP s1kv1LnfvzXxf8VbHAeFgVosX9gofJeUrYYHA4/66AThgeX7WKfaQt1AAq7Ydrq5fcQc +pPwJJsEZaL2VNHJthiFNuVN+zYm9tJ/QyJA4501qLOXvnGvqEKvchs9BuOrxVA51aaL mxqXW5K/NcQ+Pp46OzFQv8IYRN2OEbWdTKzF72odMrRZy8/9NrrHPdFPuBpNDwxbp0Cv ISF0Ag6Ocr5+eAJpq3ebQ0BMTLr1Lt7FgsWDwzAz+QNHL8R3Ghm83A41ry8m7nJT3pzB BX6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779151955; x=1779756755; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=sYDly6dzMfBVk+bP7Sp71lgzYnskpjHG63z/xSSPQ2M=; b=Twrh0QUjo1CkjNsteXAFomJx15Ng2syl7Ut7RI8mdP7NuiZLfh/hDS6f7v1rY+q4cM 4dm2vHoPaRP+X/GDhOPAevwuBc/0dglwn+TPsexv0O8OiJ4gHYoTG3EFKQdyms+CPlRn snKYdPD4EF8jgo6N0RdRawViS3UK/Z/tVfL6U+hj3SFx5hpsW3GfuTOsSjCWi7lXXntl Mo20hJS03c2gWW9kaeVDnKOx/MFc6uyaTWb0WHMpYNG06I4oRVUY/Me6bgx18jDIyCND 1ahpX5olR+cJemr95VYOdjLkU8t/nrlLyZzZQpamNCre52UkxbvOq/xHaDbUdmLT2N3A M4YQ== X-Forwarded-Encrypted: i=1; AFNElJ9mZRGiHXoyptGkBwBjOkz+q+ehKIkH9jshCuupmdYFnCeTrOKYa1MHT9g7CHsPQkrRWzko4nPOYbx5AaU=@vger.kernel.org X-Gm-Message-State: AOJu0YxQXtOWO0qpLXxZeMNMUJD18eQ5hWevfJ4CLWWH2fspvpDDVEHY XXkomKdo+0WvDrXpD2XJ94gvgXb0n58/9cI78zCLrQuF+pBJEezRuBPBZMjWpOIFqSA= X-Gm-Gg: Acq92OGznlstCvOfypoFhAmLYVVfmFsLtT9XMjAAmHlZ/cv/f92+Hfu3aJuKH70ejAt ruupN4V40bPNG16mty1klLkwZScazGXXIag4lApfhINaQBIw47Su6+0mCH63eT2IgtPHYNiiNTQ iZ4kJ9s06RVAwZtkdLML8+NCE7D//11s+HtPww6is4faoD1Rjs/7DpwhKmbxWeAJGhZpTCtQtw3 bBR20S1U16Om0FCVybXfUHx7XNI7YqV5XNnI3MeCPEYzK4gb2k4cqnFHEgZGaiwPtuwWCb/Ndxu 8M2N0SSZqK2qC5QUgpu6tbIa/gGvCqflpDncfh1W/2Y5BxcDpeL6WrbOfZIaL2ZgpgAzEdaOkNv Ffjt4rUnNWVpcIVvgox+ILTsoFOGMC2kBPj4W1UdUwTbk3cL78p1H7fp7SjSWcHnlT+2tRnC0GJ Z09XJXaxC2MnkWRxH9sEvpCAWNdA== X-Received: by 2002:a05:7022:f508:b0:135:40b2:ede2 with SMTP id a92af1059eb24-13540b2ef7fmr2486006c88.3.1779151955117; Mon, 18 May 2026 17:52:35 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb93f3sm22546633c88.3.2026.05.18.17.52.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 17:52:34 -0700 (PDT) From: Abdurrahman Hussain Date: Mon, 18 May 2026 17:52:30 -0700 Subject: [PATCH v3 6/8] hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai> References: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> In-Reply-To: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain , Bartosz Golaszewski X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779151949; l=2124; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=kGAUxCtbDfmt+7K9n1CVIf/I9Exjw2mL1Khe/Uk924I=; b=9vVVO+CcgVRiqRirJmI1dL8zn8m7wPIIrw7ytI1DhMCMynB3bEERLXVdkm14ZxySs9eWEYO0i r5IYC90CXlxDB9B4gVoLnDeylPugQhUkW+RZ3r6FrpP0bsHQg+c1XSR X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_gpio_get(), adm1266_gpio_get_multiple(), and adm1266_gpio_dbg_show() all issue PMBus reads against the device but none of them take pmbus_lock. The pmbus_core framework holds pmbus_lock around its own multi-transaction sequences (notably the "set PAGE, then read paged register" pattern used by hwmon attributes), so an unlocked GPIO accessor can land between a PAGE write and the subsequent paged read in another thread and corrupt either side's view of the device state machine. Take pmbus_lock at the top of each of the three accessors via the scope-based guard(). The lock is uncontended in the common case and adds only a single mutex round-trip per call. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski --- drivers/hwmon/pmbus/adm1266.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 8b9fbb99a4bd..a80fb2ea73bd 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -172,6 +172,8 @@ static int adm1266_gpio_get(struct gpio_chip *chip, uns= igned int offset) else pmbus_cmd =3D ADM1266_PDIO_STATUS; =20 + guard(pmbus_lock)(data->client); + ret =3D i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); if (ret < 0) return ret; @@ -194,6 +196,8 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *= chip, unsigned long *mask unsigned int gpio_nr; int ret; =20 + guard(pmbus_lock)(data->client); + ret =3D i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read= _buf); if (ret < 0) return ret; @@ -235,6 +239,8 @@ static void adm1266_gpio_dbg_show(struct seq_file *s, s= truct gpio_chip *chip) int ret; int i; =20 + guard(pmbus_lock)(data->client); + for (i =3D 0; i < ADM1266_GPIO_NR; i++) { write_cmd =3D adm1266_gpio_mapping[i][1]; ret =3D adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cm= d, read_buf); --=20 2.53.0 From nobody Mon May 25 04:35:58 2026 Received: from mail-dl1-f52.google.com (mail-dl1-f52.google.com [74.125.82.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E0AB2F4A14 for ; Tue, 19 May 2026 00:52:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151959; cv=none; b=jtUmKMqKl4YjRAiFxtpboRcx47wVwu7x6GE3zYM1c1PoDWZ2lxEiATGq3PLiSM4J92/73vLJr3W9OAhFKTR9+nN8+iAyqzkE9tcYHXNn3jxPZ7E78lZJOPxFb+9qxeedmDvxRep2fxKx0p7YuvATLxhmkvh2jT+H/qEq8Ic7MKw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151959; c=relaxed/simple; bh=FDObNUWMvwjjzrN2IkV6Cgo3wEKZLI2a8RqN+knZ8DY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=JXcAqp5iyMSgCV4VV3/HSMQI0pf+IEgY6JW9M4o+oROtC2I8kE/sPUOVTXHQgia6IhyP5MYmOvvPOH0fqB7o7hZLBZBvqyq7qqMdKldD0zqjHOqz6YxCcllrG/OkbC/x2QlkyNl1GCUbR43KXVPsKLUUQKorvSlnPCcNbBdq5WI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=FokCYGVf; arc=none smtp.client-ip=74.125.82.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="FokCYGVf" Received: by mail-dl1-f52.google.com with SMTP id a92af1059eb24-12c1a170a50so3668518c88.0 for ; Mon, 18 May 2026 17:52:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1779151956; x=1779756756; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=k/5ooRxhmqvebnRUuOuBr2iP+EihWYORWSHfWOHXOBo=; b=FokCYGVfbUh3NyYoQHX98CPim+tFdcPD3ttErufWDJtZIqPQbdnPeRsCt/cv+gInSR BAdSdvFMUROPobIGUgaWJUaodkTLlj0Lizu3cM0FW1Pq8CzEj6O8W7liMNbEpVBbXxeG v6vRGyj+YiNdB/sJYyCCbA/9da4qzUi5uTnFINwKDTPQA8qUOk8oqfbYwyk7cIF1eW0s u+Sgofk85lc1fhVYTPG9ZKi4wwkehkoyx1YCKxf+ZvcodoAO3O2wzaKPMSfgxK2UhEj3 b+ny1xDjhaEVM0qBav3u1kA3jdlJFQlgpvwYTL3YWOTIeMHW1k+PJFbjvMmTTn91b+eS ev3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779151956; x=1779756756; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=k/5ooRxhmqvebnRUuOuBr2iP+EihWYORWSHfWOHXOBo=; b=AEi1NZFwKVskKHXEN9W/UhQJ5UAqUsCdaQ7+YrnCjqoHTNp83YUtlMGNvetW78iSkV clXUgqtrBRzXtjtERmpqrR3qNZOgzXWc5Ni5WhUQGeoEC3YovtAuArqmHKIDOhuxhBkE oMnA+nTGCu3mQ6AL4DJ46mSGtbmPooZDpWANQGkrebWkzcE4CA0ACripCqp/OmtVTZ3j 0fhScKaZ6KwBPMLs8cw75SDomx+kIr8RhBdW7ej5MnH/xU4UcJn/Zllt7U54T0i5yl2z UoZqdwu+niSidRq9iFiev20U73Coos7AQhUu0TKcHFh0YUTLDw4nDd6HCxS5cL9vqpr+ 1DWw== X-Forwarded-Encrypted: i=1; AFNElJ8Lhvj41eDwhr1QDe3QIgJXOJrFns4AWjwfFEFIgPACBC2DV0z4SCX9VFRg9OCG8RL5RmzAsXKRW4jsleE=@vger.kernel.org X-Gm-Message-State: AOJu0Yw4RIz3Yxe7Cz1wq4K57e3WiymCuuImhe3Gi6yz7fl0x74HOJIi k80ggJFf06WaQI8RFhUHKXp4jZenTq4uZfpXudGdAe8hJdHV1wawBU90CnEOh+6cm0s= X-Gm-Gg: Acq92OECzrfPm0JHjIAXIiGDEFtwmKLiXub5L7dCZgS6xVRNrOy3H/H6HKwzOkAOfx7 tldrug8DaKWAN0adVExbx0ZzS4EuNwtc/gewhCxwiun7zpsQDu/lIgt1GFn0TqKYozolQllQJul g2MVe1/upH7wfwpP3UVgAbeEJHV2OAkByyobFlkGNK/E2SuYTXkbtYDHBp4+wN5fj2CLNKzc4Yv W0xUpxlP1MbuzBGdZ36lzmfk1VjdIVHbe7puOcN5/3HKdRXaAO3VS+Qz4qTqzc4CNJuCICUd9s/ qR3XRsyGAcwu0RVGqbt+IkpCBYcnvb9ckCYHwl5qWSI+Fm1LMREU1gxY0Qkj63UE5K9f0h2cK53 c/e9txw89+YWc/wJPigaUHVTG7kHIFFY+87gXb7yJrczsbWE5BTE1yZctwBgZ8+5ND76Or06Tbb CRmenQTM2embxWh1rNi8gD7DL9vA== X-Received: by 2002:a05:7022:f88:b0:12c:2dd7:9099 with SMTP id a92af1059eb24-13504945cc6mr6484019c88.30.1779151956046; Mon, 18 May 2026 17:52:36 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb93f3sm22546633c88.3.2026.05.18.17.52.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 17:52:35 -0700 (PDT) From: Abdurrahman Hussain Date: Mon, 18 May 2026 17:52:31 -0700 Subject: [PATCH v3 7/8] hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai> References: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> In-Reply-To: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779151949; l=2029; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=FDObNUWMvwjjzrN2IkV6Cgo3wEKZLI2a8RqN+knZ8DY=; b=o4T0vpm7vwd7nU4PKFq3LRjfSe8OC/WKKKQElG1ohtEyZMkibITfRtuoo4iMw2HUrWZ5T/jQj fdKq75w5UTrA8wEIqtvyvFpSdRLwy/IkjcE+xsu56FiOHl5FTYfOXj8 X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip. On the first byte of every read it does a memset of data->dev_mem, walks the device blackbox through adm1266_nvmem_read_blackbox() (which issues a chain of PMBus block transactions), and then memcpys the refreshed buffer out to userspace. None of that runs under pmbus_lock today. Two consequences: - The PMBus traffic the refresh issues is not serialised against pmbus_core's own multi-step PAGE+register sequences. A paged hwmon attribute read from another thread can land between a PAGE write and the paged read in either direction and corrupt one side's view of the device state machine. - The NVMEM core does not serialise concurrent reg_read calls, so two userspace readers racing at offset 0 can interleave the memset of data->dev_mem with another reader's adm1266_nvmem_read_blackbox() refill or memcpy out, returning torn data to userspace. Take pmbus_lock at the top of adm1266_nvmem_read() via the scope-based guard(). Patch 5 of this series moves adm1266_config_nvmem() past pmbus_do_probe() so the lock is guaranteed to be live before the callback is reachable from userspace. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain --- drivers/hwmon/pmbus/adm1266.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index a80fb2ea73bd..051f4f188ec5 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -394,6 +394,8 @@ static int adm1266_nvmem_read(void *priv, unsigned int = offset, void *val, size_t if (offset + bytes > data->nvmem_config.size) return -EINVAL; =20 + guard(pmbus_lock)(data->client); + if (offset =3D=3D 0) { memset(data->dev_mem, 0, data->nvmem_config.size); =20 --=20 2.53.0 From nobody Mon May 25 04:35:58 2026 Received: from mail-dl1-f54.google.com (mail-dl1-f54.google.com [74.125.82.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 256DB2F6900 for ; Tue, 19 May 2026 00:52:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151960; cv=none; b=Aq0ABgzd+Z9i6TVLekKvsPV5X7lyPZhMbSL/9aWgGjdwKwQlQJjW6pkn7y5t3tI5z3paWSsELttzuFnTF+rN1rCWQSASjwPm50OX024l0EOUPP7q+j49JmwPGtyUuIcDiK/6l1x7/tPcvDo3+HTltRZun6GTTWnXaqlbn2+GqiA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779151960; c=relaxed/simple; bh=MbcEhPfilDl5djs8OwiISgXUAGJH031p6hDtDP0Q1lw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=LtT7RGUcrsb1yisU0erxBc9B7WHniz8AeUaEhEOEabSWsctbS+TAXZfwGN7vAd0UoRKg0vufEa4lvVQi8RHVPuds9YlL5d9EASNy4AqlAZCVQNuU2H9wE/SPHKvsc8M30bv///6Bx1e3ZswTXoM/KUjnXf0CjDNKBaZktxEqniQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=HLBhpNFK; arc=none smtp.client-ip=74.125.82.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="HLBhpNFK" Received: by mail-dl1-f54.google.com with SMTP id a92af1059eb24-134ac81c445so10801946c88.1 for ; Mon, 18 May 2026 17:52:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1779151957; x=1779756757; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=jWewpsuFbzTqoRaVPbiB62v6E+GOY+1kwxAn2d+qoXs=; b=HLBhpNFKhHmcW89rtStr/gT2BTY9pEKaCzvShRGGfeaTMbrtbKv83n4BKV+OIJcfV+ nDheqI9UjvqzcntyDsPWPkMNj2k8BEVVV9MPP1+cXrXUfjnmJPTjsL08fH/uzmLu5fxJ mAJxqRHqbABchNgCc32T/1/v8XgNzpL8U9fVVWwJWl7wye6fVgVdvCJBuGvPR/2Wu7/V GhHSr1SRrn4geRzsniihVyEOItBFmMG/V7ZgX3vDbgrlocMvnpSnt6v/hKhU6idYDfCI Qxb+NpSGkKhZnkmfRrlnQ/8OoFlI2jpCe3z7VuGLV2PKqWWmHfdOPWmQrfr27SmJK9PD 2KTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779151957; x=1779756757; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=jWewpsuFbzTqoRaVPbiB62v6E+GOY+1kwxAn2d+qoXs=; b=iOm/Ny8EaJ0lhcqwQ3zmiKlJy/rbKfrK+bEpIwtogd1rjymGdkjtnIAiKaYVx3jqQN gIZzzGduW/cABxcqIjo71VUTua3F+3+DRp/VMKiAMIyApf8wxjvklZJqiPZEdd1zoLyK gRlG/2ljDm1LXZOyTzbcOo2EfoIv9gY+d/EnkN4OlRMS8wpBKCFpnFIr/GOU709HDZRr p99dZSMwxuh21/Q/o8jqHuHhUk9kr3bF1Ivj8EgQztdZWXjTIMC0WDdgR6eNSI6uFbBz d6vp/Gv+sEQxwdw11IVjRTj1vVP5e3qx6H+u+MIFbRlf++tZ8xN4REVQJdkZ8Dbm8GjC DTMw== X-Forwarded-Encrypted: i=1; AFNElJ+wPX7IF73rLWwr18LUb2IwUkrLpO6eyzY9u3cmBgnIvBZemogx56vjQAwp19tBWyDhi2a00I0UGdfxWlM=@vger.kernel.org X-Gm-Message-State: AOJu0YxTbhGBbWWeev1K7ml250UdnXkBZJc81w0jK6l5zCxDFNZQbXd2 tHrz/WZ/y5prS2ZBFpOvkDPWjkQjRNTrCu3EAIEPtbw+YrWrtTxwzWGlo5hibEI3MHo= X-Gm-Gg: Acq92OGXbSLwa1nUQHNBRce87SUt+rW+eb+cA14AOQooXcAukbX6G062vaR2U13lNbK FHG0HjHG11H+GS2kKZYXn6jLUXaLIoX2EQIxkmn3C7xsmUVCvOOQGmxik+ibM7gvnUtuvlNZ+PH sL8dXESqhYhAwNkgbEvpo8jjck9FqOmIoUPXp7GlSjgHTV+/rNdxzIIWWfLfvbOEkMKWQYcO9k2 hxb+Fln2I7paUw+UOBLsQpAt3TDS4I2mu4o8tWAD/5zhc5uZ3NaPahfVErIl/G2da9KpitttiVF d/OrWn/BcD5WnY7Kx/cCIChHbsk7mmInlQEx/TdwCVsuyj2agW4mFHT/d/YJGmHPgEYMTOS6gL/ iZUkm1N0Ag0zUfH4PYAY/E4C6A8JVoJquSagoMfcFqsux3NAryGUXU2B7xL0OMQAXHA7wm4+MEt lYvcpMAxfAl5DWBLXKZyVhDBAb6Q== X-Received: by 2002:a05:7022:2201:b0:128:bae0:e03c with SMTP id a92af1059eb24-13504948b9cmr7313101c88.30.1779151956831; Mon, 18 May 2026 17:52:36 -0700 (PDT) Received: from [127.0.0.2] ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cbcb93f3sm22546633c88.3.2026.05.18.17.52.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 17:52:36 -0700 (PDT) From: Abdurrahman Hussain Date: Mon, 18 May 2026 17:52:32 -0700 Subject: [PATCH v3 8/8] hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai> References: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> In-Reply-To: <20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai> To: Guenter Roeck , Alexandru Tachici , Linus Walleij , Bartosz Golaszewski Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-gpio@vger.kernel.org, Abdurrahman Hussain X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779151949; l=1513; i=abdurrahman@nexthop.ai; s=20260510; h=from:subject:message-id; bh=MbcEhPfilDl5djs8OwiISgXUAGJH031p6hDtDP0Q1lw=; b=tZbataWxursToK6TwLtzAmcuF1Y17nbY6u7cTpaJYyj/zzPSkodk7mxZZH1JHVU1DnAEfVJlV wM8DBAZHWeaDlPp97HVGOW3fr13+66tWHGwfFTqkXPbMbpgV5W2XWyX X-Developer-Key: i=abdurrahman@nexthop.ai; a=ed25519; pk=omTm9cCAbO0ZhS32aKfJDKue0W3sQGpG9ub5eYHif8I= adm1266_state_read() backs the sequencer_state debugfs entry and issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE) against the device without taking pmbus_lock. pmbus_core holds pmbus_lock around its own multi-transaction sequences (notably the "set PAGE, then read paged register" pattern used by hwmon attributes), so an unlocked debugfs reader can land between a PAGE write and the subsequent paged read in another thread. READ_STATE itself is not paged, so it cannot corrupt PAGE in flight, but the same defensive serialisation that applies to the GPIO accessors applies here: any direct device access from outside pmbus_core should be ordered with respect to pmbus_core's own. Take pmbus_lock at the top of adm1266_state_read() via the scope-based guard(). Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain --- drivers/hwmon/pmbus/adm1266.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c index 051f4f188ec5..605db086236c 100644 --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c @@ -333,6 +333,7 @@ static int adm1266_state_read(struct seq_file *s, void = *pdata) struct i2c_client *client =3D to_i2c_client(dev); int ret; =20 + guard(pmbus_lock)(client); ret =3D i2c_smbus_read_word_data(client, ADM1266_READ_STATE); if (ret < 0) return ret; --=20 2.53.0