Re: hwmon: add MP2925 and MP2929 driver

[Guenter Roeck <linux@roeck-us.net>]

On 9/26/25 07:17, Colin King (gmail) wrote:
> Hi,
> 
> Static analysis on linux-next has found an issue in function mp2925_write_word_data with the following commit:
> 
> commit b3a4efc88601cb5fc97b4ae23c478700a60302da
> Author: Wensheng Wang <wenswang@yeah.net>
> Date:   Thu Sep 18 16:06:03 2025 +0800
> 
>      hwmon: add MP2925 and MP2929 driver
> 
> 
> The issue is as follows:
> 
>          case PMBUS_VOUT_OV_FAULT_LIMIT:
>          case PMBUS_VOUT_UV_FAULT_LIMIT:
>                  ret = pmbus_write_word_data(client, page, reg,
>                                              (ret & ~GENMASK(11, 0)) |
>                                  FIELD_PREP(GENMASK(11, 0),
>                                             DIV_ROUND_CLOSEST(word * MP2925_VOUT_OVUV_DIV,
> 
> MP2925_VOUT_OVUV_UINT)));
>                  break;
> 
> The call to pmbus_write_word_data() is accessing variable ret via the mask ~GENMASK(11, 0) however at this point ret has not been initialized so it contains a garbage value.
> 

Yes, that was also reported by 0-day. Patches now dropped from linux-next since I can not
figure out the intended use (datasheets are not public, or, rather, the chips don't even
officially exist).

Guenter