[PATCH] hwmon: (pmbus/mp29502) fix potential division by zero

Yang Zi posted 1 patch 1 month ago
[PATCH] hwmon: (pmbus/mp29502) fix potential division by zero
Posted by Yang Zi 1 month ago
The vout_bottom_div and ovp_div divider values are read back from the
device during identify and later used as divisors in several
DIV_ROUND_CLOSEST() calls. If the device reports a zero divider, these
divisions trigger a divide-by-zero error.

Validate the divider values as soon as they are read and return -EINVAL
if they are zero, so the driver fails probe instead of crashing later.

Signed-off-by: Yang Zi <2959243019@qq.com>
---
diff --git a/drivers/hwmon/pmbus/mp29502.c b/drivers/hwmon/pmbus/mp29502.c
index afc5e8c07e25..d606fef82b35 100644
--- a/drivers/hwmon/pmbus/mp29502.c
+++ b/drivers/hwmon/pmbus/mp29502.c
@@ -134,6 +134,8 @@ mp29502_identify_vout_divider(struct i2c_client *client, struct pmbus_driver_inf
         return ret;
 
     data->vout_bottom_div = FIELD_GET(GENMASK(11, 0), ret);
+    if (!data->vout_bottom_div)
+        return -EINVAL;
 
     ret = i2c_smbus_read_word_data(client, MFR_VOUT_PROT2);
     if (ret < 0)
@@ -160,6 +162,8 @@ mp29502_identify_ovp_divider(struct i2c_client *client, struct pmbus_driver_info
         return ret;
 
     data->ovp_div = FIELD_GET(GENMASK(9, 0), ret);
+    if (!data->ovp_div)
+        return -EINVAL;
 
     return 0;
 }


Re: [PATCH] hwmon: (pmbus/mp29502) fix potential division by zero
Posted by Guenter Roeck 1 month ago
On 8/25/26 02:07, Yang Zi wrote:
> The vout_bottom_div and ovp_div divider values are read back from the
> device during identify and later used as divisors in several
> DIV_ROUND_CLOSEST() calls. If the device reports a zero divider, these
> divisions trigger a divide-by-zero error.
> 
> Validate the divider values as soon as they are read and return -EINVAL
> if they are zero, so the driver fails probe instead of crashing later.
> 
> Signed-off-by: Yang Zi <2959243019@qq.com>
> ---
> diff --git a/drivers/hwmon/pmbus/mp29502.c b/drivers/hwmon/pmbus/mp29502.c
> index afc5e8c07e25..d606fef82b35 100644
> --- a/drivers/hwmon/pmbus/mp29502.c
> +++ b/drivers/hwmon/pmbus/mp29502.c
> @@ -134,6 +134,8 @@ mp29502_identify_vout_divider(struct i2c_client *client, struct pmbus_driver_inf
>           return ret;
>   
>       data->vout_bottom_div = FIELD_GET(GENMASK(11, 0), ret);
> +    if (!data->vout_bottom_div)
> +        return -EINVAL;
>   
>       ret = i2c_smbus_read_word_data(client, MFR_VOUT_PROT2);
>       if (ret < 0)
> @@ -160,6 +162,8 @@ mp29502_identify_ovp_divider(struct i2c_client *client, struct pmbus_driver_info
>           return ret;
>   
>       data->ovp_div = FIELD_GET(GENMASK(9, 0), ret);
> +    if (!data->ovp_div)
> +        return -EINVAL;
>   

The question here is: What does the chip do if this ever happens ?
Was this observed, or was it reported by some analysis software
as potential problem ?

The datasheet is not public, so you'll have to provide that information.
Either the returned values need to be adjusted based on the chip behavior
if any of the values is 0, or some other error code needs to be returned.
Note that -EINVAL (Invalid Argument) is wrong. Please use either -ENXIO
or -ENODEV.

Thanks,
Guenter