adm1266_firmware_revision_read() backs the firmware_revision debugfs
entry and issues an i2c_smbus_read_block_data(client,
ADM1266_IC_DEVICE_REV, buf) without taking pmbus_lock.  pmbus_core
holds pmbus_lock around its own multi-transaction sequences
(notably the "set PAGE, then read paged register" pattern used by
hwmon attributes), so an unlocked debugfs reader can land between
a PAGE write and the subsequent paged read in another thread.
IC_DEVICE_REV itself is not paged, so it cannot corrupt PAGE in
flight, but the same defensive serialisation applied to the other
adm1266 direct-device accessors applies here: any direct device
access from outside pmbus_core should be ordered with respect to
pmbus_core's own.

Take pmbus_lock at the top of adm1266_firmware_revision_read()
via the scope-based guard(), matching the pattern just applied to
adm1266_state_read() and the GPIO/NVMEM accessors.

Fixes: 7c99762af5c1 ("hwmon: (pmbus/adm1266) add firmware_revision debugfs entry")
Cc: stable@vger.kernel.org
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Assisted-by: Claude-Code:claude-opus-4-7
---
The previous "GPIO, NVMEM, and debugfs accessor fixes" series [1]
locked all the adm1266 direct-device accessors except this one,
which slipped through because firmware_revision was already in
hwmon-next when the fixes were written.  Same defensive-locking
reason as adm1266_state_read() got there; same Fixes: shape
(stable backport candidate against the original firmware_revision
patch).

[1] https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-0-e425e4f88139@nexthop.ai
---
 drivers/hwmon/pmbus/adm1266.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c
index aadca716fe7f..7f4dbc98d92a 100644
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
@@ -359,6 +359,7 @@ static int adm1266_firmware_revision_read(struct seq_file *s, void *pdata)
 	u8 buf[I2C_SMBUS_BLOCK_MAX];
 	int ret;
 
+	guard(pmbus_lock)(client);
 	ret = i2c_smbus_read_block_data(client, ADM1266_IC_DEVICE_REV, buf);
 	if (ret < 0)
 		return ret;

---
base-commit: 7e63dac55e2de42a7947613c01e3d3c0fb9c15fc
change-id: 20260520-adm1266-fwrev-fix-a011f9be598a

Best regards,
--  
Abdurrahman Hussain <abdurrahman@nexthop.ai>

On Wed, May 20, 2026 at 10:38:28AM -0700, Abdurrahman Hussain wrote:
> adm1266_firmware_revision_read() backs the firmware_revision debugfs
> entry and issues an i2c_smbus_read_block_data(client,
> ADM1266_IC_DEVICE_REV, buf) without taking pmbus_lock.  pmbus_core
> holds pmbus_lock around its own multi-transaction sequences
> (notably the "set PAGE, then read paged register" pattern used by
> hwmon attributes), so an unlocked debugfs reader can land between
> a PAGE write and the subsequent paged read in another thread.
> IC_DEVICE_REV itself is not paged, so it cannot corrupt PAGE in
> flight, but the same defensive serialisation applied to the other
> adm1266 direct-device accessors applies here: any direct device
> access from outside pmbus_core should be ordered with respect to
> pmbus_core's own.
> 
> Take pmbus_lock at the top of adm1266_firmware_revision_read()
> via the scope-based guard(), matching the pattern just applied to
> adm1266_state_read() and the GPIO/NVMEM accessors.
> 
> Fixes: 7c99762af5c1 ("hwmon: (pmbus/adm1266) add firmware_revision debugfs entry")
> Cc: stable@vger.kernel.org
> Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
> Assisted-by: Claude-Code:claude-opus-4-7
> ---
> The previous "GPIO, NVMEM, and debugfs accessor fixes" series [1]
> locked all the adm1266 direct-device accessors except this one,
> which slipped through because firmware_revision was already in
> hwmon-next when the fixes were written.  Same defensive-locking
> reason as adm1266_state_read() got there; same Fixes: shape
> (stable backport candidate against the original firmware_revision
> patch).

I completely forgot about this one. Thanks for remembering.
I squashed this patch into the firmware_revision patch.

Thanks!

Guenter