hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value

In mp2869_read_byte_data() and mp2869_read_word_data(), the return value
of pmbus_read_byte_data() for PMBUS_STATUS_MFR_SPECIFIC is used directly
inside FIELD_GET() macro arguments without error checking. If the I2C
transaction fails, a negative error code is passed to FIELD_GET() and
FIELD_PREP(), silently corrupting the status register bits being
constructed.

Extract the nested pmbus_read_byte_data() calls into a separate variable
and check for errors before use. This also eliminates a redundant duplicate
read of the same register in the PMBUS_STATUS_TEMPERATURE case.

Fixes: a3a2923aaf7f2 ("hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260317173308.382545-4-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

diff --git a/drivers/hwmon/pmbus/mp2869.c b/drivers/hwmon/pmbus/mp2869.c
index cc69a1e91dfe8abf34db20aee7411ec6ac0b8b9b..4647892e511214f8d7f1b624c4bd879f19b0bab5 100644 (file)
--- a/drivers/hwmon/pmbus/mp2869.c
+++ b/drivers/hwmon/pmbus/mp2869.c
@@ -165,7 +165,7 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg)
 {
        const struct pmbus_driver_info *info = pmbus_get_driver_info(client);
        struct mp2869_data *data = to_mp2869_data(info);
-       int ret;
+       int ret, mfr;
 
        switch (reg) {
        case PMBUS_VOUT_MODE:
@@ -188,11 +188,14 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg)
                if (ret < 0)
                        return ret;
 
+               mfr = pmbus_read_byte_data(client, page,
+                                          PMBUS_STATUS_MFR_SPECIFIC);
+               if (mfr < 0)
+                       return mfr;
+
                ret = (ret & ~GENMASK(2, 2)) |
                        FIELD_PREP(GENMASK(2, 2),
-                                  FIELD_GET(GENMASK(1, 1),
-                                            pmbus_read_byte_data(client, page,
-                                                                 PMBUS_STATUS_MFR_SPECIFIC)));
+                                  FIELD_GET(GENMASK(1, 1), mfr));
                break;
        case PMBUS_STATUS_TEMPERATURE:
                /*
@@ -207,15 +210,16 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg)
                if (ret < 0)
                        return ret;
 
+               mfr = pmbus_read_byte_data(client, page,
+                                          PMBUS_STATUS_MFR_SPECIFIC);
+               if (mfr < 0)
+                       return mfr;
+
                ret = (ret & ~GENMASK(7, 6)) |
                        FIELD_PREP(GENMASK(6, 6),
-                                  FIELD_GET(GENMASK(1, 1),
-                                            pmbus_read_byte_data(client, page,
-                                                                 PMBUS_STATUS_MFR_SPECIFIC))) |
+                                  FIELD_GET(GENMASK(1, 1), mfr)) |
                         FIELD_PREP(GENMASK(7, 7),
-                                   FIELD_GET(GENMASK(1, 1),
-                                             pmbus_read_byte_data(client, page,
-                                                                  PMBUS_STATUS_MFR_SPECIFIC)));
+                                   FIELD_GET(GENMASK(1, 1), mfr));
                break;
        default:
                ret = -ENODATA;
@@ -230,7 +234,7 @@ static int mp2869_read_word_data(struct i2c_client *client, int page, int phase,
 {
        const struct pmbus_driver_info *info = pmbus_get_driver_info(client);
        struct mp2869_data *data = to_mp2869_data(info);
-       int ret;
+       int ret, mfr;
 
        switch (reg) {
        case PMBUS_STATUS_WORD:
@@ -246,11 +250,14 @@ static int mp2869_read_word_data(struct i2c_client *client, int page, int phase,
                if (ret < 0)
                        return ret;
 
+               mfr = pmbus_read_byte_data(client, page,
+                                          PMBUS_STATUS_MFR_SPECIFIC);
+               if (mfr < 0)
+                       return mfr;
+
                ret = (ret & ~GENMASK(2, 2)) |
                         FIELD_PREP(GENMASK(2, 2),
-                                   FIELD_GET(GENMASK(1, 1),
-                                             pmbus_read_byte_data(client, page,
-                                                                  PMBUS_STATUS_MFR_SPECIFIC)));
+                                   FIELD_GET(GENMASK(1, 1), mfr));
                break;
        case PMBUS_READ_VIN:
                /*