From: Greg Kroah-Hartman Date: Sun, 22 Mar 2026 07:27:53 +0000 (+0100) Subject: 6.18-stable patches X-Git-Tag: v6.1.167~37 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=167ba0240df7d5d57c6c5c51ba52529b8aeb32f4;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: hwmon-pmbus-ina233-add-error-check-for-pmbus_read_word_data-return-value.patch hwmon-pmbus-isl68137-fix-unchecked-return-value-and-use-sysfs_emit.patch hwmon-pmbus-mp2869-check-pmbus_read_byte_data-before-using-its-return-value.patch hwmon-pmbus-mp2975-add-error-check-for-pmbus_read_word_data-return-value.patch --- diff --git a/queue-6.18/hwmon-pmbus-ina233-add-error-check-for-pmbus_read_word_data-return-value.patch b/queue-6.18/hwmon-pmbus-ina233-add-error-check-for-pmbus_read_word_data-return-value.patch new file mode 100644 index 0000000000..a190f7f568 --- /dev/null +++ b/queue-6.18/hwmon-pmbus-ina233-add-error-check-for-pmbus_read_word_data-return-value.patch @@ -0,0 +1,43 @@ +From 32f59301b9898c0ab5e72908556d553e2d481945 Mon Sep 17 00:00:00 2001 +From: Sanman Pradhan +Date: Tue, 17 Mar 2026 17:46:31 +0000 +Subject: hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value + +From: Sanman Pradhan + +commit 32f59301b9898c0ab5e72908556d553e2d481945 upstream. + +ina233_read_word_data() uses the return value of pmbus_read_word_data() +directly in a DIV_ROUND_CLOSEST() computation without first checking for +errors. If the underlying I2C transaction fails, a negative error code is +used in the arithmetic, producing a garbage sensor value instead of +propagating the error. + +Add the missing error check before using the return value. + +Fixes: b64b6cb163f16 ("hwmon: Add driver for TI INA233 Current and Power Monitor") +Cc: stable@vger.kernel.org +Signed-off-by: Sanman Pradhan +Link: https://lore.kernel.org/r/20260317174553.385567-1-sanman.pradhan@hpe.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/pmbus/ina233.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hwmon/pmbus/ina233.c b/drivers/hwmon/pmbus/ina233.c +index dde1e1678394..2d8b5a5347ed 100644 +--- a/drivers/hwmon/pmbus/ina233.c ++++ b/drivers/hwmon/pmbus/ina233.c +@@ -67,6 +67,8 @@ static int ina233_read_word_data(struct i2c_client *client, int page, + switch (reg) { + case PMBUS_VIRT_READ_VMON: + ret = pmbus_read_word_data(client, 0, 0xff, MFR_READ_VSHUNT); ++ if (ret < 0) ++ return ret; + + /* Adjust returned value to match VIN coefficients */ + /* VIN: 1.25 mV VSHUNT: 2.5 uV LSB */ +-- +2.53.0 + diff --git a/queue-6.18/hwmon-pmbus-isl68137-fix-unchecked-return-value-and-use-sysfs_emit.patch b/queue-6.18/hwmon-pmbus-isl68137-fix-unchecked-return-value-and-use-sysfs_emit.patch new file mode 100644 index 0000000000..1176251a0f --- /dev/null +++ b/queue-6.18/hwmon-pmbus-isl68137-fix-unchecked-return-value-and-use-sysfs_emit.patch @@ -0,0 +1,44 @@ +From 86259558e422b250aa6aa57163a6d759074573f5 Mon Sep 17 00:00:00 2001 +From: Sanman Pradhan +Date: Wed, 18 Mar 2026 19:40:19 +0000 +Subject: hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() + +From: Sanman Pradhan + +commit 86259558e422b250aa6aa57163a6d759074573f5 upstream. + +isl68137_avs_enable_show_page() uses the return value of +pmbus_read_byte_data() without checking for errors. If the I2C transaction +fails, a negative error code is passed through bitwise operations, +producing incorrect output. + +Add an error check to propagate the return value if it is negative. +Additionally, modernize the callback by replacing sprintf() +with sysfs_emit(). + +Fixes: 038a9c3d1e424 ("hwmon: (pmbus/isl68137) Add driver for Intersil ISL68137 PWM Controller") +Cc: stable@vger.kernel.org +Signed-off-by: Sanman Pradhan +Link: https://lore.kernel.org/r/20260318193952.47908-2-sanman.pradhan@hpe.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/pmbus/isl68137.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/pmbus/isl68137.c ++++ b/drivers/hwmon/pmbus/isl68137.c +@@ -96,8 +96,11 @@ static ssize_t isl68137_avs_enable_show_ + { + int val = pmbus_read_byte_data(client, page, PMBUS_OPERATION); + +- return sprintf(buf, "%d\n", +- (val & ISL68137_VOUT_AVS) == ISL68137_VOUT_AVS ? 1 : 0); ++ if (val < 0) ++ return val; ++ ++ return sysfs_emit(buf, "%d\n", ++ (val & ISL68137_VOUT_AVS) == ISL68137_VOUT_AVS); + } + + static ssize_t isl68137_avs_enable_store_page(struct i2c_client *client, diff --git a/queue-6.18/hwmon-pmbus-mp2869-check-pmbus_read_byte_data-before-using-its-return-value.patch b/queue-6.18/hwmon-pmbus-mp2869-check-pmbus_read_byte_data-before-using-its-return-value.patch new file mode 100644 index 0000000000..f83d9aa35b --- /dev/null +++ b/queue-6.18/hwmon-pmbus-mp2869-check-pmbus_read_byte_data-before-using-its-return-value.patch @@ -0,0 +1,114 @@ +From c6f45ed26b6eb4766db06f21ff28a97ed485bcbb Mon Sep 17 00:00:00 2001 +From: Sanman Pradhan +Date: Tue, 17 Mar 2026 17:37:41 +0000 +Subject: hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value + +From: Sanman Pradhan + +commit c6f45ed26b6eb4766db06f21ff28a97ed485bcbb upstream. + +In mp2869_read_byte_data() and mp2869_read_word_data(), the return value +of pmbus_read_byte_data() for PMBUS_STATUS_MFR_SPECIFIC is used directly +inside FIELD_GET() macro arguments without error checking. If the I2C +transaction fails, a negative error code is passed to FIELD_GET() and +FIELD_PREP(), silently corrupting the status register bits being +constructed. + +Extract the nested pmbus_read_byte_data() calls into a separate variable +and check for errors before use. This also eliminates a redundant duplicate +read of the same register in the PMBUS_STATUS_TEMPERATURE case. + +Fixes: a3a2923aaf7f2 ("hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver") +Cc: stable@vger.kernel.org +Signed-off-by: Sanman Pradhan +Link: https://lore.kernel.org/r/20260317173308.382545-4-sanman.pradhan@hpe.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/pmbus/mp2869.c | 35 +++++++++++++++++++++-------------- + 1 file changed, 21 insertions(+), 14 deletions(-) + +diff --git a/drivers/hwmon/pmbus/mp2869.c b/drivers/hwmon/pmbus/mp2869.c +index cc69a1e91dfe..4647892e5112 100644 +--- a/drivers/hwmon/pmbus/mp2869.c ++++ b/drivers/hwmon/pmbus/mp2869.c +@@ -165,7 +165,7 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg) + { + const struct pmbus_driver_info *info = pmbus_get_driver_info(client); + struct mp2869_data *data = to_mp2869_data(info); +- int ret; ++ int ret, mfr; + + switch (reg) { + case PMBUS_VOUT_MODE: +@@ -188,11 +188,14 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg) + if (ret < 0) + return ret; + ++ mfr = pmbus_read_byte_data(client, page, ++ PMBUS_STATUS_MFR_SPECIFIC); ++ if (mfr < 0) ++ return mfr; ++ + ret = (ret & ~GENMASK(2, 2)) | + FIELD_PREP(GENMASK(2, 2), +- FIELD_GET(GENMASK(1, 1), +- pmbus_read_byte_data(client, page, +- PMBUS_STATUS_MFR_SPECIFIC))); ++ FIELD_GET(GENMASK(1, 1), mfr)); + break; + case PMBUS_STATUS_TEMPERATURE: + /* +@@ -207,15 +210,16 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg) + if (ret < 0) + return ret; + ++ mfr = pmbus_read_byte_data(client, page, ++ PMBUS_STATUS_MFR_SPECIFIC); ++ if (mfr < 0) ++ return mfr; ++ + ret = (ret & ~GENMASK(7, 6)) | + FIELD_PREP(GENMASK(6, 6), +- FIELD_GET(GENMASK(1, 1), +- pmbus_read_byte_data(client, page, +- PMBUS_STATUS_MFR_SPECIFIC))) | ++ FIELD_GET(GENMASK(1, 1), mfr)) | + FIELD_PREP(GENMASK(7, 7), +- FIELD_GET(GENMASK(1, 1), +- pmbus_read_byte_data(client, page, +- PMBUS_STATUS_MFR_SPECIFIC))); ++ FIELD_GET(GENMASK(1, 1), mfr)); + break; + default: + ret = -ENODATA; +@@ -230,7 +234,7 @@ static int mp2869_read_word_data(struct i2c_client *client, int page, int phase, + { + const struct pmbus_driver_info *info = pmbus_get_driver_info(client); + struct mp2869_data *data = to_mp2869_data(info); +- int ret; ++ int ret, mfr; + + switch (reg) { + case PMBUS_STATUS_WORD: +@@ -246,11 +250,14 @@ static int mp2869_read_word_data(struct i2c_client *client, int page, int phase, + if (ret < 0) + return ret; + ++ mfr = pmbus_read_byte_data(client, page, ++ PMBUS_STATUS_MFR_SPECIFIC); ++ if (mfr < 0) ++ return mfr; ++ + ret = (ret & ~GENMASK(2, 2)) | + FIELD_PREP(GENMASK(2, 2), +- FIELD_GET(GENMASK(1, 1), +- pmbus_read_byte_data(client, page, +- PMBUS_STATUS_MFR_SPECIFIC))); ++ FIELD_GET(GENMASK(1, 1), mfr)); + break; + case PMBUS_READ_VIN: + /* +-- +2.53.0 + diff --git a/queue-6.18/hwmon-pmbus-mp2975-add-error-check-for-pmbus_read_word_data-return-value.patch b/queue-6.18/hwmon-pmbus-mp2975-add-error-check-for-pmbus_read_word_data-return-value.patch new file mode 100644 index 0000000000..6f6c19559e --- /dev/null +++ b/queue-6.18/hwmon-pmbus-mp2975-add-error-check-for-pmbus_read_word_data-return-value.patch @@ -0,0 +1,38 @@ +From 19d4b9c8a136704d5f2544e7ac550f27918a5004 Mon Sep 17 00:00:00 2001 +From: Sanman Pradhan +Date: Tue, 17 Mar 2026 17:37:17 +0000 +Subject: hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value + +From: Sanman Pradhan + +commit 19d4b9c8a136704d5f2544e7ac550f27918a5004 upstream. + +mp2973_read_word_data() XORs the return value of pmbus_read_word_data() +with PB_STATUS_POWER_GOOD_N without first checking for errors. If the I2C +transaction fails, a negative error code is XORed with the constant, +producing a corrupted value that is returned as valid status data instead +of propagating the error. + +Add the missing error check before modifying the return value. + +Fixes: acda945afb465 ("hwmon: (pmbus/mp2975) Fix PGOOD in READ_STATUS_WORD") +Cc: stable@vger.kernel.org +Signed-off-by: Sanman Pradhan +Link: https://lore.kernel.org/r/20260317173308.382545-3-sanman.pradhan@hpe.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/pmbus/mp2975.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/hwmon/pmbus/mp2975.c ++++ b/drivers/hwmon/pmbus/mp2975.c +@@ -313,6 +313,8 @@ static int mp2973_read_word_data(struct + case PMBUS_STATUS_WORD: + /* MP2973 & MP2971 return PGOOD instead of PB_STATUS_POWER_GOOD_N. */ + ret = pmbus_read_word_data(client, page, phase, reg); ++ if (ret < 0) ++ return ret; + ret ^= PB_STATUS_POWER_GOOD_N; + break; + case PMBUS_OT_FAULT_LIMIT: diff --git a/queue-6.18/series b/queue-6.18/series index ca27111b56..e6e5797081 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -177,3 +177,7 @@ net-shaper-protect-from-late-creation-of-hierarchy.patch net-dsa-bcm_sf2-fix-missing-clk_disable_unprepare-in.patch icmp-fix-null-pointer-dereference-in-icmp_tag_valida.patch mptcp-fix-lock-class-name-family-in-pm_nl_create_lis.patch +hwmon-pmbus-ina233-add-error-check-for-pmbus_read_word_data-return-value.patch +hwmon-pmbus-mp2975-add-error-check-for-pmbus_read_word_data-return-value.patch +hwmon-pmbus-mp2869-check-pmbus_read_byte_data-before-using-its-return-value.patch +hwmon-pmbus-isl68137-fix-unchecked-return-value-and-use-sysfs_emit.patch