From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f53.google.com (mail-dl1-f53.google.com [74.125.82.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1035A405C31 for ; Sat, 16 May 2026 19:13:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778958788; cv=none; b=Bclesgp1s1u4kJr3K6ZQoqL7Mz9KQzgVfl3A6bkY3skkCe95Tcgl5O+w3qJcjMHVNL3O3JB9NjtwydQVBD6G+lfaTp08TgAHMg9sA8a/rlmOG49RZLzncvJCycQK2ZvN8EJPMqI/xCv6dtIM/futsj8k8q0J3bQWK7Fp9Gkewb4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778958788; c=relaxed/simple; bh=gn2uMmGVqz7bX9M35WbIy51eFSYt1rl4hYvMtRDztHc=; h=Content-Type:Date:Message-Id:Cc:Subject:From:To:Mime-Version: References:In-Reply-To; b=c+csg1lf9H+0XNzJXC1yHTSV3W6lmTxSkxNagkmKuBqZNL85RWPflHlakhQhIF3dSY57TZPRrZcQ5M06V16YL7Fdn3l9NCKdQOpOHo04pOKU4y4H7plHJGrQFAUcdKPdzlgpQxUQFg/Tn961cwUM4U8vmE6YVzMPkXkxnuxHr/U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai; spf=pass smtp.mailfrom=nexthop.ai; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b=Iuma67aS; arc=none smtp.client-ip=74.125.82.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nexthop.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nexthop.ai header.i=@nexthop.ai header.b="Iuma67aS" Received: by mail-dl1-f53.google.com with SMTP id a92af1059eb24-1330d6bb78dso797963c88.1 for ; Sat, 16 May 2026 12:13:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nexthop.ai; s=google; t=1778958786; x=1779563586; darn=vger.kernel.org; h=in-reply-to:references:content-transfer-encoding:mime-version:to :from:subject:cc:message-id:date:from:to:cc:subject:date:message-id :reply-to; bh=e8MJvVWg0F0H0jEwe7ABZnubh9KyrgWaVRhp78yyYlk=; b=Iuma67aSVt8qMWqkGW0rkta/GCsnMGN9BZte5OBOnScGEBGHP8nxDgEPHKlZnczilY bd/ojji4yWFZL+AlnXBN+2SzNznUYFvRnl9ySdRM3xPpz6NzNm75z4tIGbyyneCoXvro uWm/fLq0ity/QT5EL0wi5Jss/hZmwUJp8ZqUgVnF4oadatY6BKhA52bAMWnYbgbYC4OS xNy7ggWNBAagSm2/p9NRwGF6wMM0879RNlMeM83IPJktPaK5BehUMgY7F4cDYubqzikz 0g5AAAMYY+lxI3tfGF9KlxNgRxVge47PknLY71RVA2JyjITNvQ1zVTew/RNkn7FYxskq dSaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778958786; x=1779563586; h=in-reply-to:references:content-transfer-encoding:mime-version:to :from:subject:cc:message-id:date:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=e8MJvVWg0F0H0jEwe7ABZnubh9KyrgWaVRhp78yyYlk=; b=fbzUCXaF1n2bnz78q3M5k55wuGu7YPs8J1ZgI6hDYC//0YIlQ6gygjAHxHtbU/uO52 b5kCWGwz+L/dUTqQW0v4vOrbIcA+Xz6DxiSCaiwhIW+U12Uc3wkA82WhxQPQapuAce8B L2bWTUkEbRiTt2xlriXyknNue/eAI2U1iL5kDo7rbno+SrV2yOW/XE6Y+c5ZEWVj2V2U mWu28IDfLkUHT8n1wPxV4pNHiM3uK/fyWXtt5LuMTWELdYeTk1SswANDRx1IM+uw8cea 2p5jgzMNKiBFetp505DgAMaUlOWtfi+MEyy8V0mL22YBTZ07x8Cw3cmTyaxhGyIOs6xe AfuA== X-Forwarded-Encrypted: i=1; AFNElJ/SPrzrSSou5bGelpVqd8n/Wz+qvXwqD2VdrRCX8S2+KbyAVXo3iCvVt7YTjANDtMvyX03jHJoSzUx/FkQ=@vger.kernel.org X-Gm-Message-State: AOJu0YwA8l9F2I6GuvrboduQ4gzKT83+fXlEt2xUT2zzPo5qjB2ukJtJ I1bw6zY+Pk33rbdTXq2L2cW+6to3qvOe9nWvlVIKdOjl7UD1dRAauCaoOv7Ly0B4tsw= X-Gm-Gg: Acq92OGzKrj9ZajnUqwZtKGFuQBykoLzAY4/IjSV8MNlU+KP25nRxstV6Jew90uwCJ4 3z7nMWaPgM8xpEWgi0uL9P3PLhfXanGvSzMgwHre1KYqdFTqU5kv4EHfgP8rNalCqrCH2PCQh4K 7g8Z2slkQdtX4CFOwgC4VNax17VpsZ9TfOACUrpShRBq+uJ0HBgg6RHpyGpUlFog5Wzr0vad8ou pExOUBjjc8w/Hwqk3rWLDg8kQpYRMGGaEsrVRMNcp1n5crEqupoLgwwAPewHnkjGCIQGE5UK3LX +fYp5wgjF9NQi/89WhmzPLYGrgHeEVNsFmtNS7Nt+Aq/THufEb9rbBAnxIRxCuJzJoc+WYX9mwl qx4jazzmkt0J3yasvci+n+sKyl04R5cFSh4FpkRcVWFV2jRx7sDOahLUQDHBaFs4v4Cvj0JCxcE YDxRo43X6D/ne141gaRknz/x/vZ9cyizENvA== X-Received: by 2002:a05:7022:922:b0:132:7ab5:6cb8 with SMTP id a92af1059eb24-13504311c97mr4432138c88.2.1778958786004; Sat, 16 May 2026 12:13:06 -0700 (PDT) Received: from localhost ([50.145.100.174]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-134cb5b3c20sm15046942c88.0.2026.05.16.12.13.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 16 May 2026 12:13:05 -0700 (PDT) Content-Type: text/plain; charset=UTF-8 Date: Sat, 16 May 2026 12:13:04 -0700 Message-Id: Cc: "Jean Delvare" , , , , "Guenter Roeck" Subject: Re: [PATCH 0/5] hwmon: (pmbus/adm1266) buffer-bound and timestamp fixes From: "Abdurrahman Hussain" To: "Guenter Roeck" , "Abdurrahman Hussain" , "Alexandru Tachici" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Mailer: aerc 0.21.0 References: <20260515-adm1266-fixes-v1-0-1c1ea1349cfe@nexthop.ai> <2a3c5a65-e2b7-4159-9d3c-eb6a8a600b37@roeck-us.net> In-Reply-To: <2a3c5a65-e2b7-4159-9d3c-eb6a8a600b37@roeck-us.net> On Sat May 16, 2026 at 8:23 AM PDT, Guenter Roeck wrote: > On 5/15/26 15:11, Abdurrahman Hussain wrote: >> This series fixes five pre-existing bugs in adm1266.c that were >> surfaced by automated review of an in-flight feature series for the >> same driver [1]. None of them are introduced by that feature work -- >> they are all reachable on the existing driver as it sits in mainline. >> Sending them standalone first, with Fixes: tags and Cc: stable, so >> the feature respin (v5) can rebase on top. >>=20 >> Patch 1 fixes a CLOCK_MONOTONIC vs CLOCK_REALTIME confusion in >> adm1266_set_rtc(): the chip's SET_RTC register is documented to hold >> wall-clock seconds, but the driver currently seeds it from >> ktime_get_seconds(), giving blackbox records timestamps that reset >> to small values on every host reboot. >>=20 >> Patches 2 and 3 fix two ways the blackbox-info path can be driven >> out of bounds by a misbehaving slave: a 5-byte stack buffer that >> i2c_smbus_read_block_data() will memcpy() up to 32 bytes into, and >> a record_count loop bound taken directly from the device with no >> upper clamp against the 32-record dev_mem allocation. >>=20 >> Patches 4 and 5 fix the two ways adm1266_pmbus_block_xfer() can >> write past the end of a buffer: an off-by-one on the helper's own >> read_buf (sized for the length+payload but missing the PEC byte the >> i2c_msg length already accounts for), and a caller-side bug where >> adm1266_nvmem_read_blackbox() advances its destination pointer in >> 64-byte strides while the helper is willing to write up to 255 >> bytes per call. >>=20 >> [1] https://lore.kernel.org/r/20260512-adm1266-v3-0-a81a479b0bb0@nexthop= .ai >>=20 >> Signed-off-by: Abdurrahman Hussain >> --- >> Abdurrahman Hussain (5): >> hwmon: (pmbus/adm1266) seed timestamp from the real-time clock >> hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BL= OCK_MAX >> hwmon: (pmbus/adm1266) reject implausible blackbox record_count >> hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read = buffer >> hwmon: (pmbus/adm1266) bounce blackbox records through a protocol= -sized buffer >>=20 >> drivers/hwmon/pmbus/adm1266.c | 13 +++++++++---- >> 1 file changed, 9 insertions(+), 4 deletions(-) >> --- >> base-commit: 1f63dd8ca0dc05a8272bb8155f643c691d29bb11 >> change-id: 20260514-adm1266-fixes-853003a0fad4 >>=20 >> Best regards, >> -- >> Abdurrahman Hussain >>=20 > > Sashiko identified several issues with the driver as part of the review. > Most if not all of them seem valid, but were not introduced with this > series. I'll apply the series as is. Any fixes can come later. > > Thanks, > Guenter Thanks Guenter! I will address the issues in a follow up series. Best regards, Abdurrahman