From 5bf11b46286c91401441546087d028e14f752115 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 28 May 2026 15:41:24 +0200 Subject: [PATCH] drop some hwmon patches --- ...r-the-gpio_chip-after-pmbus_do_probe.patch | 4 +- ...he-nvmem-device-after-pmbus_do_probe.patch | 2 +- ...d-timestamp-from-the-real-time-clock.patch | 2 +- ...-gpio-pmbus-accesses-with-pmbus_lock.patch | 62 ------------------- ...-nvmem-blackbox-read-with-pmbus_lock.patch | 58 ----------------- ...r_state-debugfs-read-with-pmbus_lock.patch | 44 ------------- queue-5.15/series | 3 - ...r-the-gpio_chip-after-pmbus_do_probe.patch | 4 +- ...he-nvmem-device-after-pmbus_do_probe.patch | 2 +- ...d-timestamp-from-the-real-time-clock.patch | 2 +- ...-gpio-pmbus-accesses-with-pmbus_lock.patch | 62 ------------------- ...-nvmem-blackbox-read-with-pmbus_lock.patch | 58 ----------------- ...r_state-debugfs-read-with-pmbus_lock.patch | 44 ------------- queue-6.1/series | 3 - ...r-the-gpio_chip-after-pmbus_do_probe.patch | 4 +- ...he-nvmem-device-after-pmbus_do_probe.patch | 2 +- ...d-timestamp-from-the-real-time-clock.patch | 2 +- ...-gpio-pmbus-accesses-with-pmbus_lock.patch | 62 ------------------- ...-nvmem-blackbox-read-with-pmbus_lock.patch | 58 ----------------- ...r_state-debugfs-read-with-pmbus_lock.patch | 44 ------------- queue-6.6/series | 3 - 21 files changed, 12 insertions(+), 513 deletions(-) delete mode 100644 queue-5.15/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch delete mode 100644 queue-5.15/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch delete mode 100644 queue-5.15/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch delete mode 100644 queue-6.1/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch delete mode 100644 queue-6.1/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch delete mode 100644 queue-6.1/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch delete mode 100644 queue-6.6/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch delete mode 100644 queue-6.6/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch delete mode 100644 queue-6.6/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch diff --git a/queue-5.15/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch b/queue-5.15/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch index 3e1d882fa7..8123ef12e5 100644 --- a/queue-5.15/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch +++ b/queue-5.15/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch @@ -36,7 +36,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -470,10 +470,6 @@ static int adm1266_probe(struct i2c_clie +@@ -468,10 +468,6 @@ static int adm1266_probe(struct i2c_clie crc8_populate_msb(pmbus_crc_table, 0x7); mutex_init(&data->buf_mutex); @@ -47,7 +47,7 @@ Signed-off-by: Greg Kroah-Hartman ret = adm1266_set_rtc(data); if (ret < 0) return ret; -@@ -486,6 +482,10 @@ static int adm1266_probe(struct i2c_clie +@@ -484,6 +480,10 @@ static int adm1266_probe(struct i2c_clie if (ret) return ret; diff --git a/queue-5.15/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch b/queue-5.15/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch index b23eff4d2c..8611dca479 100644 --- a/queue-5.15/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch +++ b/queue-5.15/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -474,14 +474,14 @@ static int adm1266_probe(struct i2c_clie +@@ -472,14 +472,14 @@ static int adm1266_probe(struct i2c_clie if (ret < 0) return ret; diff --git a/queue-5.15/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch b/queue-5.15/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch index f5ee1abc72..717fc47bc1 100644 --- a/queue-5.15/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch +++ b/queue-5.15/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -436,7 +436,7 @@ static int adm1266_set_rtc(struct adm126 +@@ -434,7 +434,7 @@ static int adm1266_set_rtc(struct adm126 char write_buf[6]; int i; diff --git a/queue-5.15/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch b/queue-5.15/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch deleted file mode 100644 index 2c3e3d7110..0000000000 --- a/queue-5.15/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch +++ /dev/null @@ -1,62 +0,0 @@ -From bab8c6fb5af8df7e753d196c1262cb78e92ca872 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:30 -0700 -Subject: hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - -From: Abdurrahman Hussain - -commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 upstream. - -adm1266_gpio_get(), adm1266_gpio_get_multiple(), and -adm1266_gpio_dbg_show() all issue PMBus reads against the device but -none of them take pmbus_lock. The pmbus_core framework holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked GPIO accessor can land between a PAGE -write and the subsequent paged read in another thread and corrupt -either side's view of the device state machine. - -Take pmbus_lock at the top of each of the three accessors via the -scope-based guard(). The lock is uncontended in the common case and -adds only a single mutex round-trip per call. - -Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Reviewed-by: Bartosz Golaszewski -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -173,6 +173,8 @@ static int adm1266_gpio_get(struct gpio_ - else - pmbus_cmd = ADM1266_PDIO_STATUS; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); - if (ret < 0) - return ret; -@@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(str - unsigned int gpio_nr; - int ret; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf); - if (ret < 0) - return ret; -@@ -236,6 +240,8 @@ static void adm1266_gpio_dbg_show(struct - int ret; - int i; - -+ guard(pmbus_lock)(data->client); -+ - for (i = 0; i < ADM1266_GPIO_NR; i++) { - write_cmd = adm1266_gpio_mapping[i][1]; - ret = adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cmd, read_buf); diff --git a/queue-5.15/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch b/queue-5.15/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch deleted file mode 100644 index 8b77e07594..0000000000 --- a/queue-5.15/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:31 -0700 -Subject: hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - -From: Abdurrahman Hussain - -commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 upstream. - -adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes -when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip. -On the first byte of every read it does a memset of data->dev_mem, -walks the device blackbox through adm1266_nvmem_read_blackbox() -(which issues a chain of PMBus block transactions), and then memcpys -the refreshed buffer out to userspace. None of that runs under -pmbus_lock today. - -Two consequences: - - - The PMBus traffic the refresh issues is not serialised against - pmbus_core's own multi-step PAGE+register sequences. A paged - hwmon attribute read from another thread can land between a - PAGE write and the paged read in either direction and corrupt - one side's view of the device state machine. - - - The NVMEM core does not serialise concurrent reg_read calls, so - two userspace readers racing at offset 0 can interleave the - memset of data->dev_mem with another reader's - adm1266_nvmem_read_blackbox() refill or memcpy out, returning - torn data to userspace. - -Take pmbus_lock at the top of adm1266_nvmem_read() via the -scope-based guard(). Patch 5 of this series moves -adm1266_config_nvmem() past pmbus_do_probe() so the lock is -guaranteed to be live before the callback is reachable from -userspace. - -Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -385,6 +385,8 @@ static int adm1266_nvmem_read(void *priv - if (offset + bytes > data->nvmem_config.size) - return -EINVAL; - -+ guard(pmbus_lock)(data->client); -+ - if (offset == 0) { - memset(data->dev_mem, 0, data->nvmem_config.size); - diff --git a/queue-5.15/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch b/queue-5.15/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch deleted file mode 100644 index 1c10ea0dcc..0000000000 --- a/queue-5.15/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:32 -0700 -Subject: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock - -From: Abdurrahman Hussain - -commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 upstream. - -adm1266_state_read() backs the sequencer_state debugfs entry and -issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE) -against the device without taking pmbus_lock. pmbus_core holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked debugfs reader can land between a PAGE -write and the subsequent paged read in another thread. READ_STATE -itself is not paged, so it cannot corrupt PAGE in flight, but the -same defensive serialisation that applies to the GPIO accessors -applies here: any direct device access from outside pmbus_core -should be ordered with respect to pmbus_core's own. - -Take pmbus_lock at the top of adm1266_state_read() via the -scope-based guard(). - -Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -334,6 +334,7 @@ static int adm1266_state_read(struct seq - struct i2c_client *client = to_i2c_client(dev); - int ret; - -+ guard(pmbus_lock)(client); - ret = i2c_smbus_read_word_data(client, ADM1266_READ_STATE); - if (ret < 0) - return ret; diff --git a/queue-5.15/series b/queue-5.15/series index 027e208c1b..77222808c5 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -700,7 +700,6 @@ ipv4-raw-reject-ip_hdrincl-packets-with-ihl-5.patch ixgbevf-fix-use-after-free-in-vepa-multicast-source-pruning.patch wifi-cfg80211-advance-loop-vars-in-cfg80211_merge_profile.patch tracing-do-not-call-map-ops-elt_free-if-elt_alloc-fails.patch -hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch scsi-isci-fix-use-after-free-in-device-removal-path.patch spi-sprd-fix-error-pointer-deref-after-dma-setup-failure.patch spi-ti-qspi-fix-use-after-free-after-dma-setup-failure.patch @@ -730,5 +729,3 @@ hwmon-pmbus-adm1266-don-t-clobber-gpio-bits-before-pdio-read-in-get_multiple.pat hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-reject-short-block-read-responses-in-the-gpio-accessors.patch -hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch -hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch diff --git a/queue-6.1/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch b/queue-6.1/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch index 3e1d882fa7..8123ef12e5 100644 --- a/queue-6.1/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch +++ b/queue-6.1/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch @@ -36,7 +36,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -470,10 +470,6 @@ static int adm1266_probe(struct i2c_clie +@@ -468,10 +468,6 @@ static int adm1266_probe(struct i2c_clie crc8_populate_msb(pmbus_crc_table, 0x7); mutex_init(&data->buf_mutex); @@ -47,7 +47,7 @@ Signed-off-by: Greg Kroah-Hartman ret = adm1266_set_rtc(data); if (ret < 0) return ret; -@@ -486,6 +482,10 @@ static int adm1266_probe(struct i2c_clie +@@ -484,6 +480,10 @@ static int adm1266_probe(struct i2c_clie if (ret) return ret; diff --git a/queue-6.1/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch b/queue-6.1/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch index b23eff4d2c..8611dca479 100644 --- a/queue-6.1/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch +++ b/queue-6.1/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -474,14 +474,14 @@ static int adm1266_probe(struct i2c_clie +@@ -472,14 +472,14 @@ static int adm1266_probe(struct i2c_clie if (ret < 0) return ret; diff --git a/queue-6.1/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch b/queue-6.1/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch index f5ee1abc72..717fc47bc1 100644 --- a/queue-6.1/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch +++ b/queue-6.1/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -436,7 +436,7 @@ static int adm1266_set_rtc(struct adm126 +@@ -434,7 +434,7 @@ static int adm1266_set_rtc(struct adm126 char write_buf[6]; int i; diff --git a/queue-6.1/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch b/queue-6.1/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch deleted file mode 100644 index 2c3e3d7110..0000000000 --- a/queue-6.1/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch +++ /dev/null @@ -1,62 +0,0 @@ -From bab8c6fb5af8df7e753d196c1262cb78e92ca872 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:30 -0700 -Subject: hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - -From: Abdurrahman Hussain - -commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 upstream. - -adm1266_gpio_get(), adm1266_gpio_get_multiple(), and -adm1266_gpio_dbg_show() all issue PMBus reads against the device but -none of them take pmbus_lock. The pmbus_core framework holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked GPIO accessor can land between a PAGE -write and the subsequent paged read in another thread and corrupt -either side's view of the device state machine. - -Take pmbus_lock at the top of each of the three accessors via the -scope-based guard(). The lock is uncontended in the common case and -adds only a single mutex round-trip per call. - -Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Reviewed-by: Bartosz Golaszewski -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -173,6 +173,8 @@ static int adm1266_gpio_get(struct gpio_ - else - pmbus_cmd = ADM1266_PDIO_STATUS; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); - if (ret < 0) - return ret; -@@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(str - unsigned int gpio_nr; - int ret; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf); - if (ret < 0) - return ret; -@@ -236,6 +240,8 @@ static void adm1266_gpio_dbg_show(struct - int ret; - int i; - -+ guard(pmbus_lock)(data->client); -+ - for (i = 0; i < ADM1266_GPIO_NR; i++) { - write_cmd = adm1266_gpio_mapping[i][1]; - ret = adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cmd, read_buf); diff --git a/queue-6.1/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch b/queue-6.1/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch deleted file mode 100644 index 8b77e07594..0000000000 --- a/queue-6.1/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:31 -0700 -Subject: hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - -From: Abdurrahman Hussain - -commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 upstream. - -adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes -when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip. -On the first byte of every read it does a memset of data->dev_mem, -walks the device blackbox through adm1266_nvmem_read_blackbox() -(which issues a chain of PMBus block transactions), and then memcpys -the refreshed buffer out to userspace. None of that runs under -pmbus_lock today. - -Two consequences: - - - The PMBus traffic the refresh issues is not serialised against - pmbus_core's own multi-step PAGE+register sequences. A paged - hwmon attribute read from another thread can land between a - PAGE write and the paged read in either direction and corrupt - one side's view of the device state machine. - - - The NVMEM core does not serialise concurrent reg_read calls, so - two userspace readers racing at offset 0 can interleave the - memset of data->dev_mem with another reader's - adm1266_nvmem_read_blackbox() refill or memcpy out, returning - torn data to userspace. - -Take pmbus_lock at the top of adm1266_nvmem_read() via the -scope-based guard(). Patch 5 of this series moves -adm1266_config_nvmem() past pmbus_do_probe() so the lock is -guaranteed to be live before the callback is reachable from -userspace. - -Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -385,6 +385,8 @@ static int adm1266_nvmem_read(void *priv - if (offset + bytes > data->nvmem_config.size) - return -EINVAL; - -+ guard(pmbus_lock)(data->client); -+ - if (offset == 0) { - memset(data->dev_mem, 0, data->nvmem_config.size); - diff --git a/queue-6.1/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch b/queue-6.1/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch deleted file mode 100644 index 1c10ea0dcc..0000000000 --- a/queue-6.1/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:32 -0700 -Subject: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock - -From: Abdurrahman Hussain - -commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 upstream. - -adm1266_state_read() backs the sequencer_state debugfs entry and -issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE) -against the device without taking pmbus_lock. pmbus_core holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked debugfs reader can land between a PAGE -write and the subsequent paged read in another thread. READ_STATE -itself is not paged, so it cannot corrupt PAGE in flight, but the -same defensive serialisation that applies to the GPIO accessors -applies here: any direct device access from outside pmbus_core -should be ordered with respect to pmbus_core's own. - -Take pmbus_lock at the top of adm1266_state_read() via the -scope-based guard(). - -Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -334,6 +334,7 @@ static int adm1266_state_read(struct seq - struct i2c_client *client = to_i2c_client(dev); - int ret; - -+ guard(pmbus_lock)(client); - ret = i2c_smbus_read_word_data(client, ADM1266_READ_STATE); - if (ret < 0) - return ret; diff --git a/queue-6.1/series b/queue-6.1/series index 9bfc8a4c49..db8fd1156f 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -865,7 +865,6 @@ wifi-cfg80211-advance-loop-vars-in-cfg80211_merge_profile.patch cifs-fix-busy-dentry-used-after-unmounting.patch tracing-do-not-call-map-ops-elt_free-if-elt_alloc-fails.patch kvm-arm64-vgic-its-reject-restored-dte-with-out-of-range-num_eventid_bits.patch -hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch drm-bridge-chipone-icn6211-use-devm_drm_bridge_add-in-i2c-probe.patch scsi-isci-fix-use-after-free-in-device-removal-path.patch spi-sprd-fix-error-pointer-deref-after-dma-setup-failure.patch @@ -898,5 +897,3 @@ hwmon-pmbus-adm1266-don-t-clobber-gpio-bits-before-pdio-read-in-get_multiple.pat hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-reject-short-block-read-responses-in-the-gpio-accessors.patch -hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch -hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch diff --git a/queue-6.6/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch b/queue-6.6/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch index 8123ef12e5..4a547b08a0 100644 --- a/queue-6.6/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch +++ b/queue-6.6/hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch @@ -36,7 +36,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -468,10 +468,6 @@ static int adm1266_probe(struct i2c_clie +@@ -466,10 +466,6 @@ static int adm1266_probe(struct i2c_clie crc8_populate_msb(pmbus_crc_table, 0x7); mutex_init(&data->buf_mutex); @@ -47,7 +47,7 @@ Signed-off-by: Greg Kroah-Hartman ret = adm1266_set_rtc(data); if (ret < 0) return ret; -@@ -484,6 +480,10 @@ static int adm1266_probe(struct i2c_clie +@@ -482,6 +478,10 @@ static int adm1266_probe(struct i2c_clie if (ret) return ret; diff --git a/queue-6.6/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch b/queue-6.6/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch index 8611dca479..635655c9a5 100644 --- a/queue-6.6/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch +++ b/queue-6.6/hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -472,14 +472,14 @@ static int adm1266_probe(struct i2c_clie +@@ -470,14 +470,14 @@ static int adm1266_probe(struct i2c_clie if (ret < 0) return ret; diff --git a/queue-6.6/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch b/queue-6.6/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch index 717fc47bc1..231e4a0d7a 100644 --- a/queue-6.6/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch +++ b/queue-6.6/hwmon-pmbus-adm1266-seed-timestamp-from-the-real-time-clock.patch @@ -34,7 +34,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/hwmon/pmbus/adm1266.c +++ b/drivers/hwmon/pmbus/adm1266.c -@@ -434,7 +434,7 @@ static int adm1266_set_rtc(struct adm126 +@@ -432,7 +432,7 @@ static int adm1266_set_rtc(struct adm126 char write_buf[6]; int i; diff --git a/queue-6.6/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch b/queue-6.6/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch deleted file mode 100644 index 2c3e3d7110..0000000000 --- a/queue-6.6/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch +++ /dev/null @@ -1,62 +0,0 @@ -From bab8c6fb5af8df7e753d196c1262cb78e92ca872 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:30 -0700 -Subject: hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - -From: Abdurrahman Hussain - -commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 upstream. - -adm1266_gpio_get(), adm1266_gpio_get_multiple(), and -adm1266_gpio_dbg_show() all issue PMBus reads against the device but -none of them take pmbus_lock. The pmbus_core framework holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked GPIO accessor can land between a PAGE -write and the subsequent paged read in another thread and corrupt -either side's view of the device state machine. - -Take pmbus_lock at the top of each of the three accessors via the -scope-based guard(). The lock is uncontended in the common case and -adds only a single mutex round-trip per call. - -Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Reviewed-by: Bartosz Golaszewski -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -173,6 +173,8 @@ static int adm1266_gpio_get(struct gpio_ - else - pmbus_cmd = ADM1266_PDIO_STATUS; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf); - if (ret < 0) - return ret; -@@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(str - unsigned int gpio_nr; - int ret; - -+ guard(pmbus_lock)(data->client); -+ - ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf); - if (ret < 0) - return ret; -@@ -236,6 +240,8 @@ static void adm1266_gpio_dbg_show(struct - int ret; - int i; - -+ guard(pmbus_lock)(data->client); -+ - for (i = 0; i < ADM1266_GPIO_NR; i++) { - write_cmd = adm1266_gpio_mapping[i][1]; - ret = adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cmd, read_buf); diff --git a/queue-6.6/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch b/queue-6.6/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch deleted file mode 100644 index da6d945b6a..0000000000 --- a/queue-6.6/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:31 -0700 -Subject: hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - -From: Abdurrahman Hussain - -commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 upstream. - -adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes -when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip. -On the first byte of every read it does a memset of data->dev_mem, -walks the device blackbox through adm1266_nvmem_read_blackbox() -(which issues a chain of PMBus block transactions), and then memcpys -the refreshed buffer out to userspace. None of that runs under -pmbus_lock today. - -Two consequences: - - - The PMBus traffic the refresh issues is not serialised against - pmbus_core's own multi-step PAGE+register sequences. A paged - hwmon attribute read from another thread can land between a - PAGE write and the paged read in either direction and corrupt - one side's view of the device state machine. - - - The NVMEM core does not serialise concurrent reg_read calls, so - two userspace readers racing at offset 0 can interleave the - memset of data->dev_mem with another reader's - adm1266_nvmem_read_blackbox() refill or memcpy out, returning - torn data to userspace. - -Take pmbus_lock at the top of adm1266_nvmem_read() via the -scope-based guard(). Patch 5 of this series moves -adm1266_config_nvmem() past pmbus_do_probe() so the lock is -guaranteed to be live before the callback is reachable from -userspace. - -Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -383,6 +383,8 @@ static int adm1266_nvmem_read(void *priv - if (offset + bytes > data->nvmem_config.size) - return -EINVAL; - -+ guard(pmbus_lock)(data->client); -+ - if (offset == 0) { - memset(data->dev_mem, 0, data->nvmem_config.size); - diff --git a/queue-6.6/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch b/queue-6.6/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch deleted file mode 100644 index 1c10ea0dcc..0000000000 --- a/queue-6.6/hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Mon Sep 17 00:00:00 2001 -From: Abdurrahman Hussain -Date: Mon, 18 May 2026 17:52:32 -0700 -Subject: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock - -From: Abdurrahman Hussain - -commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 upstream. - -adm1266_state_read() backs the sequencer_state debugfs entry and -issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE) -against the device without taking pmbus_lock. pmbus_core holds -pmbus_lock around its own multi-transaction sequences (notably the -"set PAGE, then read paged register" pattern used by hwmon -attributes), so an unlocked debugfs reader can land between a PAGE -write and the subsequent paged read in another thread. READ_STATE -itself is not paged, so it cannot corrupt PAGE in flight, but the -same defensive serialisation that applies to the GPIO accessors -applies here: any direct device access from outside pmbus_core -should be ordered with respect to pmbus_core's own. - -Take pmbus_lock at the top of adm1266_state_read() via the -scope-based guard(). - -Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states") -Cc: stable@vger.kernel.org -Signed-off-by: Abdurrahman Hussain -Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai -Signed-off-by: Guenter Roeck -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwmon/pmbus/adm1266.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/hwmon/pmbus/adm1266.c -+++ b/drivers/hwmon/pmbus/adm1266.c -@@ -334,6 +334,7 @@ static int adm1266_state_read(struct seq - struct i2c_client *client = to_i2c_client(dev); - int ret; - -+ guard(pmbus_lock)(client); - ret = i2c_smbus_read_word_data(client, ADM1266_READ_STATE); - if (ret < 0) - return ret; diff --git a/queue-6.6/series b/queue-6.6/series index bc5806f276..000ad6fcc7 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -58,7 +58,6 @@ cifs-fix-busy-dentry-used-after-unmounting.patch tracing-do-not-call-map-ops-elt_free-if-elt_alloc-fails.patch arm64-probes-handle-probes-on-hinted-conditional-branch-instructions.patch kvm-arm64-vgic-its-reject-restored-dte-with-out-of-range-num_eventid_bits.patch -hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch drm-bridge-chipone-icn6211-use-devm_drm_bridge_add-in-i2c-probe.patch spi-qup-fix-error-pointer-deref-after-dma-setup-failure.patch phy-tegra-xusb-fix-per-pad-high-speed-termination-calibration.patch @@ -96,5 +95,3 @@ hwmon-pmbus-adm1266-don-t-clobber-gpio-bits-before-pdio-read-in-get_multiple.pat hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch hwmon-pmbus-adm1266-reject-short-block-read-responses-in-the-gpio-accessors.patch -hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch -hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch -- 2.47.3