From 481db1a8ba5d47c0e0c8cda36459169962f8a7ea Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 28 May 2026 15:51:48 +0200 Subject: [PATCH] drop hwmon patches --- ...r-the-gpio_chip-after-pmbus_do_probe.patch | 4 +- ...he-nvmem-device-after-pmbus_do_probe.patch | 2 +- ...d-timestamp-from-the-real-time-clock.patch | 2 +- ...-gpio-pmbus-accesses-with-pmbus_lock.patch | 62 ------------------- ...-nvmem-blackbox-read-with-pmbus_lock.patch | 58 ----------------- ...r_state-debugfs-read-with-pmbus_lock.patch | 44 ------------- queue-6.12/series | 3 - ...r-the-gpio_chip-after-pmbus_do_probe.patch | 4 +- ...he-nvmem-device-after-pmbus_do_probe.patch | 2 +- ...d-timestamp-from-the-real-time-clock.patch | 2 +- ...-gpio-pmbus-accesses-with-pmbus_lock.patch | 62 ------------------- ...-nvmem-blackbox-read-with-pmbus_lock.patch | 58 ----------------- ...r_state-debugfs-read-with-pmbus_lock.patch | 44 ------------- queue-6.18/series | 3 - ...r-the-gpio_chip-after-pmbus_do_probe.patch | 4 +- ...he-nvmem-device-after-pmbus_do_probe.patch | 2 +- ...d-timestamp-from-the-real-time-clock.patch | 2 +- ...-gpio-pmbus-accesses-with-pmbus_lock.patch | 62 ------------------- ...-nvmem-blackbox-read-with-pmbus_lock.patch | 58 ----------------- ...r_state-debugfs-read-with-pmbus_lock.patch | 44 ------------- queue-7.0/series | 3 - 21 files changed, 12 insertions(+), 513 deletions(-) delete mode 100644 queue-6.12/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch delete mode 100644 queue-6.12/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch delete mode 100644 queue-6.12/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch delete mode 100644 queue-6.18/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch delete mode 100644 queue-6.18/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch delete mode 100644 queue-6.18/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch delete mode 100644 queue-7.0/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch delete mode 100644 queue-7.0/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch delete mode 100644 queue-7.0/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch diff --git a/queue-6.12/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch b/queue-6.12/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch index 8123ef12e5..4a547b08a0 100644 --- a/queue-6.12/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch +++ b/queue-6.12/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch @@ -36,7 +36,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -468,10 +468,6 @@ static int adm1266_probe(struct i2c_clie +@@ -466,10 +466,6 @@ static int adm1266_probe(struct i2c_clie crc8_populate_msb(pmbus_crc_table, 0x7); mutex_init(&data->buf_mutex); @@ -47,7 +47,7 @@ Signed-off-by: Greg Kroah-Hartman ret = adm1266_set_rtc(data); if (ret < 0) return ret; -@@ -484,6 +480,10 @@ static int adm1266_probe(struct i2c_clie +@@ -482,6 +478,10 @@ static int adm1266_probe(struct i2c_clie if (ret) return ret; diff --git a/queue-6.12/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch b/queue-6.12/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch index 8611dca479..635655c9a5 100644 --- a/queue-6.12/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch +++ b/queue-6.12/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -472,14 +472,14 @@ static int adm1266_probe(struct i2c_clie +@@ -470,14 +470,14 @@ static int adm1266_probe(struct i2c_clie if (ret < 0) return ret; diff --git a/queue-6.12/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch b/queue-6.12/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch index 717fc47bc1..231e4a0d7a 100644 --- a/queue-6.12/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch +++ b/queue-6.12/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -434,7 +434,7 @@ static int adm1266_set_rtc(struct adm126 +@@ -432,7 +432,7 @@ static int adm1266_set_rtc(struct adm126 char write_buf[6]; int i; diff --git a/queue-6.12/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch b/queue-6.12/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch deleted file mode 100644 index 2c3e3d7110..0000000000 --- a/queue-6.12/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch +++ /dev/null @@ -1,62 +0,0 @@ -From bab8c6fb5af8df7e753d196c1262cb78e92ca872 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:30 -0700 -Subject: hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - -From: Abdurrahman Hussain - -commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 upstream. - -adm1266_gpio_get(), adm1266_gpio_get_multiple(), and -adm1266_gpio_dbg_show() all issue PMBus reads against the device but -none of them take pmbus_lock. The pmbus_core framework holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked GPIO accessor can land between a PAGE -write and the subsequent paged read in another thread and corrupt -either side's view of the device state machine. - -Take pmbus_lock at the top of each of the three accessors via the -scope-based guard(). The lock is uncontended in the common case and -adds only a single mutex round-trip per call. - -Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Reviewed-by: Bartosz Golaszewski -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -173,6 +173,8 @@ static int adm1266_gpio_get(struct gpio_ - else - pmbus_cmd = ADM1266_PDIO_STATUS; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); - if (ret < 0) - return ret; -@@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(str - unsigned int gpio_nr; - int ret; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf); - if (ret < 0) - return ret; -@@ -236,6 +240,8 @@ static void adm1266_gpio_dbg_show(struct - int ret; - int i; - -+ guard(pmbus_lock)(data->client); -+ - for (i = 0; i < ADM1266_GPIO_NR; i++) { - write_cmd = adm1266_gpio_mapping[i][1]; - ret = adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cmd, read_buf); diff --git a/queue-6.12/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch b/queue-6.12/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch deleted file mode 100644 index da6d945b6a..0000000000 --- a/queue-6.12/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:31 -0700 -Subject: hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - -From: Abdurrahman Hussain - -commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 upstream. - -adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes -when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip. -On the first byte of every read it does a memset of data->dev_mem, -walks the device blackbox through adm1266_nvmem_read_blackbox() -(which issues a chain of PMBus block transactions), and then memcpys -the refreshed buffer out to userspace. None of that runs under -pmbus_lock today. - -Two consequences: - - - The PMBus traffic the refresh issues is not serialised against - pmbus_core's own multi-step PAGE+register sequences. A paged - hwmon attribute read from another thread can land between a - PAGE write and the paged read in either direction and corrupt - one side's view of the device state machine. - - - The NVMEM core does not serialise concurrent reg_read calls, so - two userspace readers racing at offset 0 can interleave the - memset of data->dev_mem with another reader's - adm1266_nvmem_read_blackbox() refill or memcpy out, returning - torn data to userspace. - -Take pmbus_lock at the top of adm1266_nvmem_read() via the -scope-based guard(). Patch 5 of this series moves -adm1266_config_nvmem() past pmbus_do_probe() so the lock is -guaranteed to be live before the callback is reachable from -userspace. - -Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -383,6 +383,8 @@ static int adm1266_nvmem_read(void *priv - if (offset + bytes > data->nvmem_config.size) - return -EINVAL; - -+ guard(pmbus_lock)(data->client); -+ - if (offset == 0) { - memset(data->dev_mem, 0, data->nvmem_config.size); - diff --git a/queue-6.12/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch b/queue-6.12/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch deleted file mode 100644 index 1c10ea0dcc..0000000000 --- a/queue-6.12/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:32 -0700 -Subject: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock - -From: Abdurrahman Hussain - -commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 upstream. - -adm1266_state_read() backs the sequencer_state debugfs entry and -issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE) -against the device without taking pmbus_lock. pmbus_core holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked debugfs reader can land between a PAGE -write and the subsequent paged read in another thread. READ_STATE -itself is not paged, so it cannot corrupt PAGE in flight, but the -same defensive serialisation that applies to the GPIO accessors -applies here: any direct device access from outside pmbus_core -should be ordered with respect to pmbus_core's own. - -Take pmbus_lock at the top of adm1266_state_read() via the -scope-based guard(). - -Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -334,6 +334,7 @@ static int adm1266_state_read(struct seq - struct i2c_client *client = to_i2c_client(dev); - int ret; - -+ guard(pmbus_lock)(client); - ret = i2c_smbus_read_word_data(client, ADM1266_READ_STATE); - if (ret < 0) - return ret; diff --git a/queue-6.12/series b/queue-6.12/series index ef1aebde73..5405477f96 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -101,7 +101,6 @@ arm64-probes-handle-probes-on-hinted-conditional-branch-instructions.patch kvm-arm64-vgic-its-reject-restored-dte-with-out-of-range-num_eventid_bits.patch kvm-arm64-vgic-free-private_irqs-when-init-fails-after-allocation.patch riscv-kvm-return-sbi_err_failure-for-pmu_snapshot_set_shmem-when-oom.patch -hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch drm-bridge-chipone-icn6211-use-devm_drm_bridge_add-in-i2c-probe.patch spi-qup-fix-error-pointer-deref-after-dma-setup-failure.patch phy-tegra-xusb-fix-per-pad-high-speed-termination-calibration.patch @@ -142,5 +141,3 @@ hwmon-pmbus-adm1266-don-t-clobber-gpio-bits-before-pdio-read-in-get_multiple.pat hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-reject-short-block-read-responses-in-the-gpio-accessors.patch -hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch -hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch diff --git a/queue-6.18/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch b/queue-6.18/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch index 8123ef12e5..4a547b08a0 100644 --- a/queue-6.18/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch +++ b/queue-6.18/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch @@ -36,7 +36,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -468,10 +468,6 @@ static int adm1266_probe(struct i2c_clie +@@ -466,10 +466,6 @@ static int adm1266_probe(struct i2c_clie crc8_populate_msb(pmbus_crc_table, 0x7); mutex_init(&data->buf_mutex); @@ -47,7 +47,7 @@ Signed-off-by: Greg Kroah-Hartman ret = adm1266_set_rtc(data); if (ret < 0) return ret; -@@ -484,6 +480,10 @@ static int adm1266_probe(struct i2c_clie +@@ -482,6 +478,10 @@ static int adm1266_probe(struct i2c_clie if (ret) return ret; diff --git a/queue-6.18/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch b/queue-6.18/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch index 8611dca479..635655c9a5 100644 --- a/queue-6.18/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch +++ b/queue-6.18/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -472,14 +472,14 @@ static int adm1266_probe(struct i2c_clie +@@ -470,14 +470,14 @@ static int adm1266_probe(struct i2c_clie if (ret < 0) return ret; diff --git a/queue-6.18/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch b/queue-6.18/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch index 717fc47bc1..231e4a0d7a 100644 --- a/queue-6.18/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch +++ b/queue-6.18/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -434,7 +434,7 @@ static int adm1266_set_rtc(struct adm126 +@@ -432,7 +432,7 @@ static int adm1266_set_rtc(struct adm126 char write_buf[6]; int i; diff --git a/queue-6.18/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch b/queue-6.18/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch deleted file mode 100644 index 2c3e3d7110..0000000000 --- a/queue-6.18/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch +++ /dev/null @@ -1,62 +0,0 @@ -From bab8c6fb5af8df7e753d196c1262cb78e92ca872 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:30 -0700 -Subject: hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - -From: Abdurrahman Hussain - -commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 upstream. - -adm1266_gpio_get(), adm1266_gpio_get_multiple(), and -adm1266_gpio_dbg_show() all issue PMBus reads against the device but -none of them take pmbus_lock. The pmbus_core framework holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked GPIO accessor can land between a PAGE -write and the subsequent paged read in another thread and corrupt -either side's view of the device state machine. - -Take pmbus_lock at the top of each of the three accessors via the -scope-based guard(). The lock is uncontended in the common case and -adds only a single mutex round-trip per call. - -Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Reviewed-by: Bartosz Golaszewski -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -173,6 +173,8 @@ static int adm1266_gpio_get(struct gpio_ - else - pmbus_cmd = ADM1266_PDIO_STATUS; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); - if (ret < 0) - return ret; -@@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(str - unsigned int gpio_nr; - int ret; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf); - if (ret < 0) - return ret; -@@ -236,6 +240,8 @@ static void adm1266_gpio_dbg_show(struct - int ret; - int i; - -+ guard(pmbus_lock)(data->client); -+ - for (i = 0; i < ADM1266_GPIO_NR; i++) { - write_cmd = adm1266_gpio_mapping[i][1]; - ret = adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cmd, read_buf); diff --git a/queue-6.18/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch b/queue-6.18/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch deleted file mode 100644 index da6d945b6a..0000000000 --- a/queue-6.18/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:31 -0700 -Subject: hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - -From: Abdurrahman Hussain - -commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 upstream. - -adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes -when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip. -On the first byte of every read it does a memset of data->dev_mem, -walks the device blackbox through adm1266_nvmem_read_blackbox() -(which issues a chain of PMBus block transactions), and then memcpys -the refreshed buffer out to userspace. None of that runs under -pmbus_lock today. - -Two consequences: - - - The PMBus traffic the refresh issues is not serialised against - pmbus_core's own multi-step PAGE+register sequences. A paged - hwmon attribute read from another thread can land between a - PAGE write and the paged read in either direction and corrupt - one side's view of the device state machine. - - - The NVMEM core does not serialise concurrent reg_read calls, so - two userspace readers racing at offset 0 can interleave the - memset of data->dev_mem with another reader's - adm1266_nvmem_read_blackbox() refill or memcpy out, returning - torn data to userspace. - -Take pmbus_lock at the top of adm1266_nvmem_read() via the -scope-based guard(). Patch 5 of this series moves -adm1266_config_nvmem() past pmbus_do_probe() so the lock is -guaranteed to be live before the callback is reachable from -userspace. - -Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -383,6 +383,8 @@ static int adm1266_nvmem_read(void *priv - if (offset + bytes > data->nvmem_config.size) - return -EINVAL; - -+ guard(pmbus_lock)(data->client); -+ - if (offset == 0) { - memset(data->dev_mem, 0, data->nvmem_config.size); - diff --git a/queue-6.18/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch b/queue-6.18/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch deleted file mode 100644 index 1c10ea0dcc..0000000000 --- a/queue-6.18/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:32 -0700 -Subject: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock - -From: Abdurrahman Hussain - -commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 upstream. - -adm1266_state_read() backs the sequencer_state debugfs entry and -issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE) -against the device without taking pmbus_lock. pmbus_core holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked debugfs reader can land between a PAGE -write and the subsequent paged read in another thread. READ_STATE -itself is not paged, so it cannot corrupt PAGE in flight, but the -same defensive serialisation that applies to the GPIO accessors -applies here: any direct device access from outside pmbus_core -should be ordered with respect to pmbus_core's own. - -Take pmbus_lock at the top of adm1266_state_read() via the -scope-based guard(). - -Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -334,6 +334,7 @@ static int adm1266_state_read(struct seq - struct i2c_client *client = to_i2c_client(dev); - int ret; - -+ guard(pmbus_lock)(client); - ret = i2c_smbus_read_word_data(client, ADM1266_READ_STATE); - if (ret < 0) - return ret; diff --git a/queue-6.18/series b/queue-6.18/series index c29a46f82a..2b48ba8cc6 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -110,7 +110,6 @@ kvm-svm-disable-avic-ipi-virtualization-on-hygon-family-18h-erratum-1235.patch riscv-kvm-return-sbi_err_failure-for-pmu_snapshot_set_shmem-when-oom.patch riscv-kvm-return-sbi_err_failure-for-pmu_event_info-when-oom.patch virt-sev-guest-explicitly-leak-pages-in-unknown-state.patch -hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch drm-bridge-chipone-icn6211-use-devm_drm_bridge_add-in-i2c-probe.patch spi-qup-fix-error-pointer-deref-after-dma-setup-failure.patch phy-exynos5-usbdrd-fix-usb-2.0-hs-phy-tuning-values-for-exynos7870.patch @@ -169,5 +168,3 @@ hwmon-pmbus-adm1266-don-t-clobber-gpio-bits-before-pdio-read-in-get_multiple.pat hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-reject-short-block-read-responses-in-the-gpio-accessors.patch -hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch -hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch diff --git a/queue-7.0/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch b/queue-7.0/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch index 8123ef12e5..4a547b08a0 100644 --- a/queue-7.0/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch +++ b/queue-7.0/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch @@ -36,7 +36,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -468,10 +468,6 @@ static int adm1266_probe(struct i2c_clie +@@ -466,10 +466,6 @@ static int adm1266_probe(struct i2c_clie crc8_populate_msb(pmbus_crc_table, 0x7); mutex_init(&data->buf_mutex); @@ -47,7 +47,7 @@ Signed-off-by: Greg Kroah-Hartman ret = adm1266_set_rtc(data); if (ret < 0) return ret; -@@ -484,6 +480,10 @@ static int adm1266_probe(struct i2c_clie +@@ -482,6 +478,10 @@ static int adm1266_probe(struct i2c_clie if (ret) return ret; diff --git a/queue-7.0/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch b/queue-7.0/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch index 8611dca479..635655c9a5 100644 --- a/queue-7.0/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch +++ b/queue-7.0/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -472,14 +472,14 @@ static int adm1266_probe(struct i2c_clie +@@ -470,14 +470,14 @@ static int adm1266_probe(struct i2c_clie if (ret < 0) return ret; diff --git a/queue-7.0/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch b/queue-7.0/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch index 717fc47bc1..231e4a0d7a 100644 --- a/queue-7.0/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch +++ b/queue-7.0/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -434,7 +434,7 @@ static int adm1266_set_rtc(struct adm126 +@@ -432,7 +432,7 @@ static int adm1266_set_rtc(struct adm126 char write_buf[6]; int i; diff --git a/queue-7.0/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch b/queue-7.0/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch deleted file mode 100644 index 2c3e3d7110..0000000000 --- a/queue-7.0/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch +++ /dev/null @@ -1,62 +0,0 @@ -From bab8c6fb5af8df7e753d196c1262cb78e92ca872 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:30 -0700 -Subject: hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - -From: Abdurrahman Hussain - -commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 upstream. - -adm1266_gpio_get(), adm1266_gpio_get_multiple(), and -adm1266_gpio_dbg_show() all issue PMBus reads against the device but -none of them take pmbus_lock. The pmbus_core framework holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked GPIO accessor can land between a PAGE -write and the subsequent paged read in another thread and corrupt -either side's view of the device state machine. - -Take pmbus_lock at the top of each of the three accessors via the -scope-based guard(). The lock is uncontended in the common case and -adds only a single mutex round-trip per call. - -Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Reviewed-by: Bartosz Golaszewski -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -173,6 +173,8 @@ static int adm1266_gpio_get(struct gpio_ - else - pmbus_cmd = ADM1266_PDIO_STATUS; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); - if (ret < 0) - return ret; -@@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(str - unsigned int gpio_nr; - int ret; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf); - if (ret < 0) - return ret; -@@ -236,6 +240,8 @@ static void adm1266_gpio_dbg_show(struct - int ret; - int i; - -+ guard(pmbus_lock)(data->client); -+ - for (i = 0; i < ADM1266_GPIO_NR; i++) { - write_cmd = adm1266_gpio_mapping[i][1]; - ret = adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cmd, read_buf); diff --git a/queue-7.0/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch b/queue-7.0/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch deleted file mode 100644 index da6d945b6a..0000000000 --- a/queue-7.0/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:31 -0700 -Subject: hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - -From: Abdurrahman Hussain - -commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 upstream. - -adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes -when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip. -On the first byte of every read it does a memset of data->dev_mem, -walks the device blackbox through adm1266_nvmem_read_blackbox() -(which issues a chain of PMBus block transactions), and then memcpys -the refreshed buffer out to userspace. None of that runs under -pmbus_lock today. - -Two consequences: - - - The PMBus traffic the refresh issues is not serialised against - pmbus_core's own multi-step PAGE+register sequences. A paged - hwmon attribute read from another thread can land between a - PAGE write and the paged read in either direction and corrupt - one side's view of the device state machine. - - - The NVMEM core does not serialise concurrent reg_read calls, so - two userspace readers racing at offset 0 can interleave the - memset of data->dev_mem with another reader's - adm1266_nvmem_read_blackbox() refill or memcpy out, returning - torn data to userspace. - -Take pmbus_lock at the top of adm1266_nvmem_read() via the -scope-based guard(). Patch 5 of this series moves -adm1266_config_nvmem() past pmbus_do_probe() so the lock is -guaranteed to be live before the callback is reachable from -userspace. - -Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -383,6 +383,8 @@ static int adm1266_nvmem_read(void *priv - if (offset + bytes > data->nvmem_config.size) - return -EINVAL; - -+ guard(pmbus_lock)(data->client); -+ - if (offset == 0) { - memset(data->dev_mem, 0, data->nvmem_config.size); - diff --git a/queue-7.0/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch b/queue-7.0/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch deleted file mode 100644 index 1c10ea0dcc..0000000000 --- a/queue-7.0/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:32 -0700 -Subject: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock - -From: Abdurrahman Hussain - -commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 upstream. - -adm1266_state_read() backs the sequencer_state debugfs entry and -issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE) -against the device without taking pmbus_lock. pmbus_core holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked debugfs reader can land between a PAGE -write and the subsequent paged read in another thread. READ_STATE -itself is not paged, so it cannot corrupt PAGE in flight, but the -same defensive serialisation that applies to the GPIO accessors -applies here: any direct device access from outside pmbus_core -should be ordered with respect to pmbus_core's own. - -Take pmbus_lock at the top of adm1266_state_read() via the -scope-based guard(). - -Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -334,6 +334,7 @@ static int adm1266_state_read(struct seq - struct i2c_client *client = to_i2c_client(dev); - int ret; - -+ guard(pmbus_lock)(client); - ret = i2c_smbus_read_word_data(client, ADM1266_READ_STATE); - if (ret < 0) - return ret; diff --git a/queue-7.0/series b/queue-7.0/series index e482f99285..e88c6ceb9d 100644 --- a/queue-7.0/series +++ b/queue-7.0/series @@ -104,7 +104,6 @@ riscv-kvm-return-sbi_err_failure-for-pmu_snapshot_set_shmem-when-oom.patch riscv-kvm-return-sbi_err_failure-for-pmu_event_info-when-oom.patch virt-sev-guest-explicitly-leak-pages-in-unknown-state.patch i2c-tegra-fix-pm_runtime-leak-on-mutex_lock-failure.patch -hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch drm-bridge-chipone-icn6211-use-devm_drm_bridge_add-in-i2c-probe.patch spi-qup-fix-error-pointer-deref-after-dma-setup-failure.patch phy-exynos5-usbdrd-fix-usb-2.0-hs-phy-tuning-values-for-exynos7870.patch @@ -173,5 +172,3 @@ hwmon-pmbus-adm1266-don-t-clobber-gpio-bits-before-pdio-read-in-get_multiple.pat hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-reject-short-block-read-responses-in-the-gpio-accessors.patch -hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch -hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch -- 2.47.3