--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -470,10 +470,6 @@ static int adm1266_probe(struct i2c_clie
+@@ -468,10 +468,6 @@ static int adm1266_probe(struct i2c_clie
crc8_populate_msb(pmbus_crc_table, 0x7);
mutex_init(&data->buf_mutex);
ret = adm1266_set_rtc(data);
if (ret < 0)
return ret;
-@@ -486,6 +482,10 @@ static int adm1266_probe(struct i2c_clie
+@@ -484,6 +480,10 @@ static int adm1266_probe(struct i2c_clie
if (ret)
return ret;
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -474,14 +474,14 @@ static int adm1266_probe(struct i2c_clie
+@@ -472,14 +472,14 @@ static int adm1266_probe(struct i2c_clie
if (ret < 0)
return ret;
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -436,7 +436,7 @@ static int adm1266_set_rtc(struct adm126
+@@ -434,7 +434,7 @@ static int adm1266_set_rtc(struct adm126
char write_buf[6];
int i;
+++ /dev/null
-From bab8c6fb5af8df7e753d196c1262cb78e92ca872 Mon Sep 17 00:00:00 2001
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Date: Mon, 18 May 2026 17:52:30 -0700
-Subject: hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
-
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-
-commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 upstream.
-
-adm1266_gpio_get(), adm1266_gpio_get_multiple(), and
-adm1266_gpio_dbg_show() all issue PMBus reads against the device but
-none of them take pmbus_lock. The pmbus_core framework holds
-pmbus_lock around its own multi-transaction sequences (notably the
-"set PAGE, then read paged register" pattern used by hwmon
-attributes), so an unlocked GPIO accessor can land between a PAGE
-write and the subsequent paged read in another thread and corrupt
-either side's view of the device state machine.
-
-Take pmbus_lock at the top of each of the three accessors via the
-scope-based guard(). The lock is uncontended in the common case and
-adds only a single mutex round-trip per call.
-
-Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs")
-Cc: stable@vger.kernel.org
-Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
-Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/hwmon/pmbus/adm1266.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/drivers/hwmon/pmbus/adm1266.c
-+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -173,6 +173,8 @@ static int adm1266_gpio_get(struct gpio_
- else
- pmbus_cmd = ADM1266_PDIO_STATUS;
-
-+ guard(pmbus_lock)(data->client);
-+
- ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf);
- if (ret < 0)
- return ret;
-@@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(str
- unsigned int gpio_nr;
- int ret;
-
-+ guard(pmbus_lock)(data->client);
-+
- ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf);
- if (ret < 0)
- return ret;
-@@ -236,6 +240,8 @@ static void adm1266_gpio_dbg_show(struct
- int ret;
- int i;
-
-+ guard(pmbus_lock)(data->client);
-+
- for (i = 0; i < ADM1266_GPIO_NR; i++) {
- write_cmd = adm1266_gpio_mapping[i][1];
- ret = adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cmd, read_buf);
+++ /dev/null
-From 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Mon Sep 17 00:00:00 2001
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Date: Mon, 18 May 2026 17:52:31 -0700
-Subject: hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
-
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-
-commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 upstream.
-
-adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes
-when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip.
-On the first byte of every read it does a memset of data->dev_mem,
-walks the device blackbox through adm1266_nvmem_read_blackbox()
-(which issues a chain of PMBus block transactions), and then memcpys
-the refreshed buffer out to userspace. None of that runs under
-pmbus_lock today.
-
-Two consequences:
-
- - The PMBus traffic the refresh issues is not serialised against
- pmbus_core's own multi-step PAGE+register sequences. A paged
- hwmon attribute read from another thread can land between a
- PAGE write and the paged read in either direction and corrupt
- one side's view of the device state machine.
-
- - The NVMEM core does not serialise concurrent reg_read calls, so
- two userspace readers racing at offset 0 can interleave the
- memset of data->dev_mem with another reader's
- adm1266_nvmem_read_blackbox() refill or memcpy out, returning
- torn data to userspace.
-
-Take pmbus_lock at the top of adm1266_nvmem_read() via the
-scope-based guard(). Patch 5 of this series moves
-adm1266_config_nvmem() past pmbus_do_probe() so the lock is
-guaranteed to be live before the callback is reachable from
-userspace.
-
-Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox")
-Cc: stable@vger.kernel.org
-Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/hwmon/pmbus/adm1266.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/hwmon/pmbus/adm1266.c
-+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -385,6 +385,8 @@ static int adm1266_nvmem_read(void *priv
- if (offset + bytes > data->nvmem_config.size)
- return -EINVAL;
-
-+ guard(pmbus_lock)(data->client);
-+
- if (offset == 0) {
- memset(data->dev_mem, 0, data->nvmem_config.size);
-
+++ /dev/null
-From 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Mon Sep 17 00:00:00 2001
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Date: Mon, 18 May 2026 17:52:32 -0700
-Subject: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
-
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-
-commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 upstream.
-
-adm1266_state_read() backs the sequencer_state debugfs entry and
-issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE)
-against the device without taking pmbus_lock. pmbus_core holds
-pmbus_lock around its own multi-transaction sequences (notably the
-"set PAGE, then read paged register" pattern used by hwmon
-attributes), so an unlocked debugfs reader can land between a PAGE
-write and the subsequent paged read in another thread. READ_STATE
-itself is not paged, so it cannot corrupt PAGE in flight, but the
-same defensive serialisation that applies to the GPIO accessors
-applies here: any direct device access from outside pmbus_core
-should be ordered with respect to pmbus_core's own.
-
-Take pmbus_lock at the top of adm1266_state_read() via the
-scope-based guard().
-
-Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states")
-Cc: stable@vger.kernel.org
-Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/hwmon/pmbus/adm1266.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/hwmon/pmbus/adm1266.c
-+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -334,6 +334,7 @@ static int adm1266_state_read(struct seq
- struct i2c_client *client = to_i2c_client(dev);
- int ret;
-
-+ guard(pmbus_lock)(client);
- ret = i2c_smbus_read_word_data(client, ADM1266_READ_STATE);
- if (ret < 0)
- return ret;
ixgbevf-fix-use-after-free-in-vepa-multicast-source-pruning.patch
wifi-cfg80211-advance-loop-vars-in-cfg80211_merge_profile.patch
tracing-do-not-call-map-ops-elt_free-if-elt_alloc-fails.patch
-hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch
scsi-isci-fix-use-after-free-in-device-removal-path.patch
spi-sprd-fix-error-pointer-deref-after-dma-setup-failure.patch
spi-ti-qspi-fix-use-after-free-after-dma-setup-failure.patch
hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch
hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch
hwmon-pmbus-adm1266-reject-short-block-read-responses-in-the-gpio-accessors.patch
-hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch
-hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -470,10 +470,6 @@ static int adm1266_probe(struct i2c_clie
+@@ -468,10 +468,6 @@ static int adm1266_probe(struct i2c_clie
crc8_populate_msb(pmbus_crc_table, 0x7);
mutex_init(&data->buf_mutex);
ret = adm1266_set_rtc(data);
if (ret < 0)
return ret;
-@@ -486,6 +482,10 @@ static int adm1266_probe(struct i2c_clie
+@@ -484,6 +480,10 @@ static int adm1266_probe(struct i2c_clie
if (ret)
return ret;
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -474,14 +474,14 @@ static int adm1266_probe(struct i2c_clie
+@@ -472,14 +472,14 @@ static int adm1266_probe(struct i2c_clie
if (ret < 0)
return ret;
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -436,7 +436,7 @@ static int adm1266_set_rtc(struct adm126
+@@ -434,7 +434,7 @@ static int adm1266_set_rtc(struct adm126
char write_buf[6];
int i;
+++ /dev/null
-From bab8c6fb5af8df7e753d196c1262cb78e92ca872 Mon Sep 17 00:00:00 2001
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Date: Mon, 18 May 2026 17:52:30 -0700
-Subject: hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
-
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-
-commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 upstream.
-
-adm1266_gpio_get(), adm1266_gpio_get_multiple(), and
-adm1266_gpio_dbg_show() all issue PMBus reads against the device but
-none of them take pmbus_lock. The pmbus_core framework holds
-pmbus_lock around its own multi-transaction sequences (notably the
-"set PAGE, then read paged register" pattern used by hwmon
-attributes), so an unlocked GPIO accessor can land between a PAGE
-write and the subsequent paged read in another thread and corrupt
-either side's view of the device state machine.
-
-Take pmbus_lock at the top of each of the three accessors via the
-scope-based guard(). The lock is uncontended in the common case and
-adds only a single mutex round-trip per call.
-
-Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs")
-Cc: stable@vger.kernel.org
-Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
-Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/hwmon/pmbus/adm1266.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/drivers/hwmon/pmbus/adm1266.c
-+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -173,6 +173,8 @@ static int adm1266_gpio_get(struct gpio_
- else
- pmbus_cmd = ADM1266_PDIO_STATUS;
-
-+ guard(pmbus_lock)(data->client);
-+
- ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf);
- if (ret < 0)
- return ret;
-@@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(str
- unsigned int gpio_nr;
- int ret;
-
-+ guard(pmbus_lock)(data->client);
-+
- ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf);
- if (ret < 0)
- return ret;
-@@ -236,6 +240,8 @@ static void adm1266_gpio_dbg_show(struct
- int ret;
- int i;
-
-+ guard(pmbus_lock)(data->client);
-+
- for (i = 0; i < ADM1266_GPIO_NR; i++) {
- write_cmd = adm1266_gpio_mapping[i][1];
- ret = adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cmd, read_buf);
+++ /dev/null
-From 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Mon Sep 17 00:00:00 2001
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Date: Mon, 18 May 2026 17:52:31 -0700
-Subject: hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
-
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-
-commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 upstream.
-
-adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes
-when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip.
-On the first byte of every read it does a memset of data->dev_mem,
-walks the device blackbox through adm1266_nvmem_read_blackbox()
-(which issues a chain of PMBus block transactions), and then memcpys
-the refreshed buffer out to userspace. None of that runs under
-pmbus_lock today.
-
-Two consequences:
-
- - The PMBus traffic the refresh issues is not serialised against
- pmbus_core's own multi-step PAGE+register sequences. A paged
- hwmon attribute read from another thread can land between a
- PAGE write and the paged read in either direction and corrupt
- one side's view of the device state machine.
-
- - The NVMEM core does not serialise concurrent reg_read calls, so
- two userspace readers racing at offset 0 can interleave the
- memset of data->dev_mem with another reader's
- adm1266_nvmem_read_blackbox() refill or memcpy out, returning
- torn data to userspace.
-
-Take pmbus_lock at the top of adm1266_nvmem_read() via the
-scope-based guard(). Patch 5 of this series moves
-adm1266_config_nvmem() past pmbus_do_probe() so the lock is
-guaranteed to be live before the callback is reachable from
-userspace.
-
-Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox")
-Cc: stable@vger.kernel.org
-Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/hwmon/pmbus/adm1266.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/hwmon/pmbus/adm1266.c
-+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -385,6 +385,8 @@ static int adm1266_nvmem_read(void *priv
- if (offset + bytes > data->nvmem_config.size)
- return -EINVAL;
-
-+ guard(pmbus_lock)(data->client);
-+
- if (offset == 0) {
- memset(data->dev_mem, 0, data->nvmem_config.size);
-
+++ /dev/null
-From 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Mon Sep 17 00:00:00 2001
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Date: Mon, 18 May 2026 17:52:32 -0700
-Subject: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
-
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-
-commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 upstream.
-
-adm1266_state_read() backs the sequencer_state debugfs entry and
-issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE)
-against the device without taking pmbus_lock. pmbus_core holds
-pmbus_lock around its own multi-transaction sequences (notably the
-"set PAGE, then read paged register" pattern used by hwmon
-attributes), so an unlocked debugfs reader can land between a PAGE
-write and the subsequent paged read in another thread. READ_STATE
-itself is not paged, so it cannot corrupt PAGE in flight, but the
-same defensive serialisation that applies to the GPIO accessors
-applies here: any direct device access from outside pmbus_core
-should be ordered with respect to pmbus_core's own.
-
-Take pmbus_lock at the top of adm1266_state_read() via the
-scope-based guard().
-
-Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states")
-Cc: stable@vger.kernel.org
-Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/hwmon/pmbus/adm1266.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/hwmon/pmbus/adm1266.c
-+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -334,6 +334,7 @@ static int adm1266_state_read(struct seq
- struct i2c_client *client = to_i2c_client(dev);
- int ret;
-
-+ guard(pmbus_lock)(client);
- ret = i2c_smbus_read_word_data(client, ADM1266_READ_STATE);
- if (ret < 0)
- return ret;
cifs-fix-busy-dentry-used-after-unmounting.patch
tracing-do-not-call-map-ops-elt_free-if-elt_alloc-fails.patch
kvm-arm64-vgic-its-reject-restored-dte-with-out-of-range-num_eventid_bits.patch
-hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch
drm-bridge-chipone-icn6211-use-devm_drm_bridge_add-in-i2c-probe.patch
scsi-isci-fix-use-after-free-in-device-removal-path.patch
spi-sprd-fix-error-pointer-deref-after-dma-setup-failure.patch
hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch
hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch
hwmon-pmbus-adm1266-reject-short-block-read-responses-in-the-gpio-accessors.patch
-hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch
-hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -468,10 +468,6 @@ static int adm1266_probe(struct i2c_clie
+@@ -466,10 +466,6 @@ static int adm1266_probe(struct i2c_clie
crc8_populate_msb(pmbus_crc_table, 0x7);
mutex_init(&data->buf_mutex);
ret = adm1266_set_rtc(data);
if (ret < 0)
return ret;
-@@ -484,6 +480,10 @@ static int adm1266_probe(struct i2c_clie
+@@ -482,6 +478,10 @@ static int adm1266_probe(struct i2c_clie
if (ret)
return ret;
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -472,14 +472,14 @@ static int adm1266_probe(struct i2c_clie
+@@ -470,14 +470,14 @@ static int adm1266_probe(struct i2c_clie
if (ret < 0)
return ret;
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -434,7 +434,7 @@ static int adm1266_set_rtc(struct adm126
+@@ -432,7 +432,7 @@ static int adm1266_set_rtc(struct adm126
char write_buf[6];
int i;
+++ /dev/null
-From bab8c6fb5af8df7e753d196c1262cb78e92ca872 Mon Sep 17 00:00:00 2001
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Date: Mon, 18 May 2026 17:52:30 -0700
-Subject: hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
-
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-
-commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 upstream.
-
-adm1266_gpio_get(), adm1266_gpio_get_multiple(), and
-adm1266_gpio_dbg_show() all issue PMBus reads against the device but
-none of them take pmbus_lock. The pmbus_core framework holds
-pmbus_lock around its own multi-transaction sequences (notably the
-"set PAGE, then read paged register" pattern used by hwmon
-attributes), so an unlocked GPIO accessor can land between a PAGE
-write and the subsequent paged read in another thread and corrupt
-either side's view of the device state machine.
-
-Take pmbus_lock at the top of each of the three accessors via the
-scope-based guard(). The lock is uncontended in the common case and
-adds only a single mutex round-trip per call.
-
-Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs")
-Cc: stable@vger.kernel.org
-Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
-Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/hwmon/pmbus/adm1266.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/drivers/hwmon/pmbus/adm1266.c
-+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -173,6 +173,8 @@ static int adm1266_gpio_get(struct gpio_
- else
- pmbus_cmd = ADM1266_PDIO_STATUS;
-
-+ guard(pmbus_lock)(data->client);
-+
- ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf);
- if (ret < 0)
- return ret;
-@@ -195,6 +197,8 @@ static int adm1266_gpio_get_multiple(str
- unsigned int gpio_nr;
- int ret;
-
-+ guard(pmbus_lock)(data->client);
-+
- ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf);
- if (ret < 0)
- return ret;
-@@ -236,6 +240,8 @@ static void adm1266_gpio_dbg_show(struct
- int ret;
- int i;
-
-+ guard(pmbus_lock)(data->client);
-+
- for (i = 0; i < ADM1266_GPIO_NR; i++) {
- write_cmd = adm1266_gpio_mapping[i][1];
- ret = adm1266_pmbus_block_xfer(data, ADM1266_GPIO_CONFIG, 1, &write_cmd, read_buf);
+++ /dev/null
-From 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Mon Sep 17 00:00:00 2001
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Date: Mon, 18 May 2026 17:52:31 -0700
-Subject: hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
-
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-
-commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 upstream.
-
-adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes
-when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip.
-On the first byte of every read it does a memset of data->dev_mem,
-walks the device blackbox through adm1266_nvmem_read_blackbox()
-(which issues a chain of PMBus block transactions), and then memcpys
-the refreshed buffer out to userspace. None of that runs under
-pmbus_lock today.
-
-Two consequences:
-
- - The PMBus traffic the refresh issues is not serialised against
- pmbus_core's own multi-step PAGE+register sequences. A paged
- hwmon attribute read from another thread can land between a
- PAGE write and the paged read in either direction and corrupt
- one side's view of the device state machine.
-
- - The NVMEM core does not serialise concurrent reg_read calls, so
- two userspace readers racing at offset 0 can interleave the
- memset of data->dev_mem with another reader's
- adm1266_nvmem_read_blackbox() refill or memcpy out, returning
- torn data to userspace.
-
-Take pmbus_lock at the top of adm1266_nvmem_read() via the
-scope-based guard(). Patch 5 of this series moves
-adm1266_config_nvmem() past pmbus_do_probe() so the lock is
-guaranteed to be live before the callback is reachable from
-userspace.
-
-Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox")
-Cc: stable@vger.kernel.org
-Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/hwmon/pmbus/adm1266.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/hwmon/pmbus/adm1266.c
-+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -383,6 +383,8 @@ static int adm1266_nvmem_read(void *priv
- if (offset + bytes > data->nvmem_config.size)
- return -EINVAL;
-
-+ guard(pmbus_lock)(data->client);
-+
- if (offset == 0) {
- memset(data->dev_mem, 0, data->nvmem_config.size);
-
+++ /dev/null
-From 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Mon Sep 17 00:00:00 2001
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Date: Mon, 18 May 2026 17:52:32 -0700
-Subject: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
-
-From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-
-commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 upstream.
-
-adm1266_state_read() backs the sequencer_state debugfs entry and
-issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE)
-against the device without taking pmbus_lock. pmbus_core holds
-pmbus_lock around its own multi-transaction sequences (notably the
-"set PAGE, then read paged register" pattern used by hwmon
-attributes), so an unlocked debugfs reader can land between a PAGE
-write and the subsequent paged read in another thread. READ_STATE
-itself is not paged, so it cannot corrupt PAGE in flight, but the
-same defensive serialisation that applies to the GPIO accessors
-applies here: any direct device access from outside pmbus_core
-should be ordered with respect to pmbus_core's own.
-
-Take pmbus_lock at the top of adm1266_state_read() via the
-scope-based guard().
-
-Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states")
-Cc: stable@vger.kernel.org
-Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
-Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/hwmon/pmbus/adm1266.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/hwmon/pmbus/adm1266.c
-+++ b/drivers/hwmon/pmbus/adm1266.c
-@@ -334,6 +334,7 @@ static int adm1266_state_read(struct seq
- struct i2c_client *client = to_i2c_client(dev);
- int ret;
-
-+ guard(pmbus_lock)(client);
- ret = i2c_smbus_read_word_data(client, ADM1266_READ_STATE);
- if (ret < 0)
- return ret;
tracing-do-not-call-map-ops-elt_free-if-elt_alloc-fails.patch
arm64-probes-handle-probes-on-hinted-conditional-branch-instructions.patch
kvm-arm64-vgic-its-reject-restored-dte-with-out-of-range-num_eventid_bits.patch
-hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-with-pmbus_lock.patch
drm-bridge-chipone-icn6211-use-devm_drm_bridge_add-in-i2c-probe.patch
spi-qup-fix-error-pointer-deref-after-dma-setup-failure.patch
phy-tegra-xusb-fix-per-pad-high-speed-termination-calibration.patch
hwmon-pmbus-adm1266-register-the-gpio_chip-after-pmbus_do_probe.patch
hwmon-pmbus-adm1266-register-the-nvmem-device-after-pmbus_do_probe.patch
hwmon-pmbus-adm1266-reject-short-block-read-responses-in-the-gpio-accessors.patch
-hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-with-pmbus_lock.patch
-hwmon-pmbus-adm1266-serialize-sequencer_state-debugfs-read-with-pmbus_lock.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
