--- /dev/null
+From 32f59301b9898c0ab5e72908556d553e2d481945 Mon Sep 17 00:00:00 2001
+From: Sanman Pradhan <psanman@juniper.net>
+Date: Tue, 17 Mar 2026 17:46:31 +0000
+Subject: hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+commit 32f59301b9898c0ab5e72908556d553e2d481945 upstream.
+
+ina233_read_word_data() uses the return value of pmbus_read_word_data()
+directly in a DIV_ROUND_CLOSEST() computation without first checking for
+errors. If the underlying I2C transaction fails, a negative error code is
+used in the arithmetic, producing a garbage sensor value instead of
+propagating the error.
+
+Add the missing error check before using the return value.
+
+Fixes: b64b6cb163f16 ("hwmon: Add driver for TI INA233 Current and Power Monitor")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260317174553.385567-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/pmbus/ina233.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hwmon/pmbus/ina233.c b/drivers/hwmon/pmbus/ina233.c
+index dde1e1678394..2d8b5a5347ed 100644
+--- a/drivers/hwmon/pmbus/ina233.c
++++ b/drivers/hwmon/pmbus/ina233.c
+@@ -67,6 +67,8 @@ static int ina233_read_word_data(struct i2c_client *client, int page,
+ switch (reg) {
+ case PMBUS_VIRT_READ_VMON:
+ ret = pmbus_read_word_data(client, 0, 0xff, MFR_READ_VSHUNT);
++ if (ret < 0)
++ return ret;
+
+ /* Adjust returned value to match VIN coefficients */
+ /* VIN: 1.25 mV VSHUNT: 2.5 uV LSB */
+--
+2.53.0
+
--- /dev/null
+From 86259558e422b250aa6aa57163a6d759074573f5 Mon Sep 17 00:00:00 2001
+From: Sanman Pradhan <psanman@juniper.net>
+Date: Wed, 18 Mar 2026 19:40:19 +0000
+Subject: hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+commit 86259558e422b250aa6aa57163a6d759074573f5 upstream.
+
+isl68137_avs_enable_show_page() uses the return value of
+pmbus_read_byte_data() without checking for errors. If the I2C transaction
+fails, a negative error code is passed through bitwise operations,
+producing incorrect output.
+
+Add an error check to propagate the return value if it is negative.
+Additionally, modernize the callback by replacing sprintf()
+with sysfs_emit().
+
+Fixes: 038a9c3d1e424 ("hwmon: (pmbus/isl68137) Add driver for Intersil ISL68137 PWM Controller")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260318193952.47908-2-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/pmbus/isl68137.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/pmbus/isl68137.c
++++ b/drivers/hwmon/pmbus/isl68137.c
+@@ -96,8 +96,11 @@ static ssize_t isl68137_avs_enable_show_
+ {
+ int val = pmbus_read_byte_data(client, page, PMBUS_OPERATION);
+
+- return sprintf(buf, "%d\n",
+- (val & ISL68137_VOUT_AVS) == ISL68137_VOUT_AVS ? 1 : 0);
++ if (val < 0)
++ return val;
++
++ return sysfs_emit(buf, "%d\n",
++ (val & ISL68137_VOUT_AVS) == ISL68137_VOUT_AVS);
+ }
+
+ static ssize_t isl68137_avs_enable_store_page(struct i2c_client *client,
--- /dev/null
+From c6f45ed26b6eb4766db06f21ff28a97ed485bcbb Mon Sep 17 00:00:00 2001
+From: Sanman Pradhan <psanman@juniper.net>
+Date: Tue, 17 Mar 2026 17:37:41 +0000
+Subject: hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+commit c6f45ed26b6eb4766db06f21ff28a97ed485bcbb upstream.
+
+In mp2869_read_byte_data() and mp2869_read_word_data(), the return value
+of pmbus_read_byte_data() for PMBUS_STATUS_MFR_SPECIFIC is used directly
+inside FIELD_GET() macro arguments without error checking. If the I2C
+transaction fails, a negative error code is passed to FIELD_GET() and
+FIELD_PREP(), silently corrupting the status register bits being
+constructed.
+
+Extract the nested pmbus_read_byte_data() calls into a separate variable
+and check for errors before use. This also eliminates a redundant duplicate
+read of the same register in the PMBUS_STATUS_TEMPERATURE case.
+
+Fixes: a3a2923aaf7f2 ("hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260317173308.382545-4-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/pmbus/mp2869.c | 35 +++++++++++++++++++++--------------
+ 1 file changed, 21 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/mp2869.c b/drivers/hwmon/pmbus/mp2869.c
+index cc69a1e91dfe..4647892e5112 100644
+--- a/drivers/hwmon/pmbus/mp2869.c
++++ b/drivers/hwmon/pmbus/mp2869.c
+@@ -165,7 +165,7 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg)
+ {
+ const struct pmbus_driver_info *info = pmbus_get_driver_info(client);
+ struct mp2869_data *data = to_mp2869_data(info);
+- int ret;
++ int ret, mfr;
+
+ switch (reg) {
+ case PMBUS_VOUT_MODE:
+@@ -188,11 +188,14 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg)
+ if (ret < 0)
+ return ret;
+
++ mfr = pmbus_read_byte_data(client, page,
++ PMBUS_STATUS_MFR_SPECIFIC);
++ if (mfr < 0)
++ return mfr;
++
+ ret = (ret & ~GENMASK(2, 2)) |
+ FIELD_PREP(GENMASK(2, 2),
+- FIELD_GET(GENMASK(1, 1),
+- pmbus_read_byte_data(client, page,
+- PMBUS_STATUS_MFR_SPECIFIC)));
++ FIELD_GET(GENMASK(1, 1), mfr));
+ break;
+ case PMBUS_STATUS_TEMPERATURE:
+ /*
+@@ -207,15 +210,16 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg)
+ if (ret < 0)
+ return ret;
+
++ mfr = pmbus_read_byte_data(client, page,
++ PMBUS_STATUS_MFR_SPECIFIC);
++ if (mfr < 0)
++ return mfr;
++
+ ret = (ret & ~GENMASK(7, 6)) |
+ FIELD_PREP(GENMASK(6, 6),
+- FIELD_GET(GENMASK(1, 1),
+- pmbus_read_byte_data(client, page,
+- PMBUS_STATUS_MFR_SPECIFIC))) |
++ FIELD_GET(GENMASK(1, 1), mfr)) |
+ FIELD_PREP(GENMASK(7, 7),
+- FIELD_GET(GENMASK(1, 1),
+- pmbus_read_byte_data(client, page,
+- PMBUS_STATUS_MFR_SPECIFIC)));
++ FIELD_GET(GENMASK(1, 1), mfr));
+ break;
+ default:
+ ret = -ENODATA;
+@@ -230,7 +234,7 @@ static int mp2869_read_word_data(struct i2c_client *client, int page, int phase,
+ {
+ const struct pmbus_driver_info *info = pmbus_get_driver_info(client);
+ struct mp2869_data *data = to_mp2869_data(info);
+- int ret;
++ int ret, mfr;
+
+ switch (reg) {
+ case PMBUS_STATUS_WORD:
+@@ -246,11 +250,14 @@ static int mp2869_read_word_data(struct i2c_client *client, int page, int phase,
+ if (ret < 0)
+ return ret;
+
++ mfr = pmbus_read_byte_data(client, page,
++ PMBUS_STATUS_MFR_SPECIFIC);
++ if (mfr < 0)
++ return mfr;
++
+ ret = (ret & ~GENMASK(2, 2)) |
+ FIELD_PREP(GENMASK(2, 2),
+- FIELD_GET(GENMASK(1, 1),
+- pmbus_read_byte_data(client, page,
+- PMBUS_STATUS_MFR_SPECIFIC)));
++ FIELD_GET(GENMASK(1, 1), mfr));
+ break;
+ case PMBUS_READ_VIN:
+ /*
+--
+2.53.0
+
--- /dev/null
+From 19d4b9c8a136704d5f2544e7ac550f27918a5004 Mon Sep 17 00:00:00 2001
+From: Sanman Pradhan <psanman@juniper.net>
+Date: Tue, 17 Mar 2026 17:37:17 +0000
+Subject: hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+commit 19d4b9c8a136704d5f2544e7ac550f27918a5004 upstream.
+
+mp2973_read_word_data() XORs the return value of pmbus_read_word_data()
+with PB_STATUS_POWER_GOOD_N without first checking for errors. If the I2C
+transaction fails, a negative error code is XORed with the constant,
+producing a corrupted value that is returned as valid status data instead
+of propagating the error.
+
+Add the missing error check before modifying the return value.
+
+Fixes: acda945afb465 ("hwmon: (pmbus/mp2975) Fix PGOOD in READ_STATUS_WORD")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260317173308.382545-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/pmbus/mp2975.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwmon/pmbus/mp2975.c
++++ b/drivers/hwmon/pmbus/mp2975.c
+@@ -313,6 +313,8 @@ static int mp2973_read_word_data(struct
+ case PMBUS_STATUS_WORD:
+ /* MP2973 & MP2971 return PGOOD instead of PB_STATUS_POWER_GOOD_N. */
+ ret = pmbus_read_word_data(client, page, phase, reg);
++ if (ret < 0)
++ return ret;
+ ret ^= PB_STATUS_POWER_GOOD_N;
+ break;
+ case PMBUS_OT_FAULT_LIMIT:
net-dsa-bcm_sf2-fix-missing-clk_disable_unprepare-in.patch
icmp-fix-null-pointer-dereference-in-icmp_tag_valida.patch
mptcp-fix-lock-class-name-family-in-pm_nl_create_lis.patch
+hwmon-pmbus-ina233-add-error-check-for-pmbus_read_word_data-return-value.patch
+hwmon-pmbus-mp2975-add-error-check-for-pmbus_read_word_data-return-value.patch
+hwmon-pmbus-mp2869-check-pmbus_read_byte_data-before-using-its-return-value.patch
+hwmon-pmbus-isl68137-fix-unchecked-return-value-and-use-sysfs_emit.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
