[PATCH 0/5] hwmon: (pmbus) Fix unchecked error returns in multiple drivers

[PATCH 0/5] hwmon: (pmbus) Fix unchecked error returns in multiple drivers

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@juniper.net>

Several PMBus device drivers use the return value of pmbus_read_word_data()
or pmbus_read_byte_data() in arithmetic, bitwise, or macro operations
without first checking for a negative error code. If the underlying I2C
transaction fails, the negative errno propagates into FIELD_GET(),
FIELD_PREP(), XOR, or DIV_ROUND_CLOSEST operations, silently producing
corrupted sensor or status data instead of reporting the error.

Sanman Pradhan (5):
  hwmon: (pmbus/hac300s) Add error check for pmbus_read_word_data()
    return value
  hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data()
    return value
  hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its
    return value
  hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data()
    return value
  hwmon: (pmbus/isl68137) Fix unchecked return value and use
    sysfs_emit()

 drivers/hwmon/pmbus/hac300s.c  |  2 ++
 drivers/hwmon/pmbus/ina233.c   |  2 ++
 drivers/hwmon/pmbus/isl68137.c |  7 +++++--
 drivers/hwmon/pmbus/mp2869.c   | 35 ++++++++++++++++++++--------------
 drivers/hwmon/pmbus/mp2975.c   |  2 ++
 5 files changed, 32 insertions(+), 16 deletions(-)

-- 
2.34.1

[PATCH 1/5] hwmon: (pmbus/hac300s) Add error check for pmbus_read_word_data() return value

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@juniper.net>

hac300s_read_word_data() passes the return value of pmbus_read_word_data()
directly to FIELD_GET() without checking for errors. If the I2C transaction
fails, a negative error code is sign-extended and passed to FIELD_GET(),
which silently produces garbage data instead of propagating the error.

Add the missing error check before using the return value in
the FIELD_GET() macro.

Fixes: 669cf162f7a1 ("hwmon: Add support for HiTRON HAC300S PSU")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
---
 drivers/hwmon/pmbus/hac300s.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwmon/pmbus/hac300s.c b/drivers/hwmon/pmbus/hac300s.c
index 0a1d52cae91ed..a073db1cfe2e4 100644
--- a/drivers/hwmon/pmbus/hac300s.c
+++ b/drivers/hwmon/pmbus/hac300s.c
@@ -58,6 +58,8 @@ static int hac300s_read_word_data(struct i2c_client *client, int page,
 	case PMBUS_MFR_VOUT_MIN:
 	case PMBUS_READ_VOUT:
 		rv = pmbus_read_word_data(client, page, phase, reg);
+		if (rv < 0)
+			return rv;
 		return FIELD_GET(LINEAR11_MANTISSA_MASK, rv);
 	default:
 		return -ENODATA;
-- 
2.34.1

Re: [PATCH 1/5] hwmon: (pmbus/hac300s) Add error check for pmbus_read_word_data() return value

[Guenter Roeck]

On Tue, Mar 17, 2026 at 05:36:53PM +0000, Pradhan, Sanman wrote:
> From: Sanman Pradhan <psanman@juniper.net>
> 
> hac300s_read_word_data() passes the return value of pmbus_read_word_data()
> directly to FIELD_GET() without checking for errors. If the I2C transaction
> fails, a negative error code is sign-extended and passed to FIELD_GET(),
> which silently produces garbage data instead of propagating the error.
> 
> Add the missing error check before using the return value in
> the FIELD_GET() macro.
> 
> Fixes: 669cf162f7a1 ("hwmon: Add support for HiTRON HAC300S PSU")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sanman Pradhan <psanman@juniper.net>

Applied.

Thanks,
Guenter

[PATCH 2/5] hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@juniper.net>

mp2973_read_word_data() XORs the return value of pmbus_read_word_data()
with PB_STATUS_POWER_GOOD_N without first checking for errors. If the I2C
transaction fails, a negative error code is XORed with the constant,
producing a corrupted value that is returned as valid status data instead
of propagating the error.

Add the missing error check before modifying the return value.

Fixes: acda945afb465 ("hwmon: (pmbus/mp2975) Fix PGOOD in READ_STATUS_WORD")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
---
 drivers/hwmon/pmbus/mp2975.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwmon/pmbus/mp2975.c b/drivers/hwmon/pmbus/mp2975.c
index c31982d851962..d0bc47b12cb07 100644
--- a/drivers/hwmon/pmbus/mp2975.c
+++ b/drivers/hwmon/pmbus/mp2975.c
@@ -313,6 +313,8 @@ static int mp2973_read_word_data(struct i2c_client *client, int page,
 	case PMBUS_STATUS_WORD:
 		/* MP2973 & MP2971 return PGOOD instead of PB_STATUS_POWER_GOOD_N. */
 		ret = pmbus_read_word_data(client, page, phase, reg);
+		if (ret < 0)
+			return ret;
 		ret ^= PB_STATUS_POWER_GOOD_N;
 		break;
 	case PMBUS_OT_FAULT_LIMIT:
-- 
2.34.1

Re: [PATCH 2/5] hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value

[Guenter Roeck]

On Tue, Mar 17, 2026 at 05:37:17PM +0000, Pradhan, Sanman wrote:
> From: Sanman Pradhan <psanman@juniper.net>
> 
> mp2973_read_word_data() XORs the return value of pmbus_read_word_data()
> with PB_STATUS_POWER_GOOD_N without first checking for errors. If the I2C
> transaction fails, a negative error code is XORed with the constant,
> producing a corrupted value that is returned as valid status data instead
> of propagating the error.
> 
> Add the missing error check before modifying the return value.
> 
> Fixes: acda945afb465 ("hwmon: (pmbus/mp2975) Fix PGOOD in READ_STATUS_WORD")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sanman Pradhan <psanman@juniper.net>

Applied.

Thanks,
Guenter

[PATCH 3/5] hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@juniper.net>

In mp2869_read_byte_data() and mp2869_read_word_data(), the return value
of pmbus_read_byte_data() for PMBUS_STATUS_MFR_SPECIFIC is used directly
inside FIELD_GET() macro arguments without error checking. If the I2C
transaction fails, a negative error code is passed to FIELD_GET() and
FIELD_PREP(), silently corrupting the status register bits being
constructed.

Extract the nested pmbus_read_byte_data() calls into a separate variable
and check for errors before use. This also eliminates a redundant duplicate
read of the same register in the PMBUS_STATUS_TEMPERATURE case.

Fixes: a3a2923aaf7f2 ("hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
---
 drivers/hwmon/pmbus/mp2869.c | 35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/drivers/hwmon/pmbus/mp2869.c b/drivers/hwmon/pmbus/mp2869.c
index cc69a1e91dfe8..4647892e51121 100644
--- a/drivers/hwmon/pmbus/mp2869.c
+++ b/drivers/hwmon/pmbus/mp2869.c
@@ -165,7 +165,7 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg)
 {
 	const struct pmbus_driver_info *info = pmbus_get_driver_info(client);
 	struct mp2869_data *data = to_mp2869_data(info);
-	int ret;
+	int ret, mfr;
 
 	switch (reg) {
 	case PMBUS_VOUT_MODE:
@@ -188,11 +188,14 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg)
 		if (ret < 0)
 			return ret;
 
+		mfr = pmbus_read_byte_data(client, page,
+					   PMBUS_STATUS_MFR_SPECIFIC);
+		if (mfr < 0)
+			return mfr;
+
 		ret = (ret & ~GENMASK(2, 2)) |
 			FIELD_PREP(GENMASK(2, 2),
-				   FIELD_GET(GENMASK(1, 1),
-					     pmbus_read_byte_data(client, page,
-								  PMBUS_STATUS_MFR_SPECIFIC)));
+				   FIELD_GET(GENMASK(1, 1), mfr));
 		break;
 	case PMBUS_STATUS_TEMPERATURE:
 		/*
@@ -207,15 +210,16 @@ static int mp2869_read_byte_data(struct i2c_client *client, int page, int reg)
 		if (ret < 0)
 			return ret;
 
+		mfr = pmbus_read_byte_data(client, page,
+					   PMBUS_STATUS_MFR_SPECIFIC);
+		if (mfr < 0)
+			return mfr;
+
 		ret = (ret & ~GENMASK(7, 6)) |
 			FIELD_PREP(GENMASK(6, 6),
-				   FIELD_GET(GENMASK(1, 1),
-					     pmbus_read_byte_data(client, page,
-								  PMBUS_STATUS_MFR_SPECIFIC))) |
+				   FIELD_GET(GENMASK(1, 1), mfr)) |
 			 FIELD_PREP(GENMASK(7, 7),
-				    FIELD_GET(GENMASK(1, 1),
-					      pmbus_read_byte_data(client, page,
-								   PMBUS_STATUS_MFR_SPECIFIC)));
+				    FIELD_GET(GENMASK(1, 1), mfr));
 		break;
 	default:
 		ret = -ENODATA;
@@ -230,7 +234,7 @@ static int mp2869_read_word_data(struct i2c_client *client, int page, int phase,
 {
 	const struct pmbus_driver_info *info = pmbus_get_driver_info(client);
 	struct mp2869_data *data = to_mp2869_data(info);
-	int ret;
+	int ret, mfr;
 
 	switch (reg) {
 	case PMBUS_STATUS_WORD:
@@ -246,11 +250,14 @@ static int mp2869_read_word_data(struct i2c_client *client, int page, int phase,
 		if (ret < 0)
 			return ret;
 
+		mfr = pmbus_read_byte_data(client, page,
+					   PMBUS_STATUS_MFR_SPECIFIC);
+		if (mfr < 0)
+			return mfr;
+
 		ret = (ret & ~GENMASK(2, 2)) |
 			 FIELD_PREP(GENMASK(2, 2),
-				    FIELD_GET(GENMASK(1, 1),
-					      pmbus_read_byte_data(client, page,
-								   PMBUS_STATUS_MFR_SPECIFIC)));
+				    FIELD_GET(GENMASK(1, 1), mfr));
 		break;
 	case PMBUS_READ_VIN:
 		/*
-- 
2.34.1

Re: [PATCH 3/5] hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value

[Guenter Roeck]

On Tue, Mar 17, 2026 at 05:37:41PM +0000, Pradhan, Sanman wrote:
> From: Sanman Pradhan <psanman@juniper.net>
> 
> In mp2869_read_byte_data() and mp2869_read_word_data(), the return value
> of pmbus_read_byte_data() for PMBUS_STATUS_MFR_SPECIFIC is used directly
> inside FIELD_GET() macro arguments without error checking. If the I2C
> transaction fails, a negative error code is passed to FIELD_GET() and
> FIELD_PREP(), silently corrupting the status register bits being
> constructed.
> 
> Extract the nested pmbus_read_byte_data() calls into a separate variable
> and check for errors before use. This also eliminates a redundant duplicate
> read of the same register in the PMBUS_STATUS_TEMPERATURE case.
> 
> Fixes: a3a2923aaf7f2 ("hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sanman Pradhan <psanman@juniper.net>

Applied.

Thanks,
Guenter

[PATCH 4/5] hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@juniper.net>

ina233_read_word_data() uses the return value of pmbus_read_word_data()
directly in a DIV_ROUND_CLOSEST() computation without first checking for
errors. If the underlying I2C transaction fails, a negative error code is
used in the arithmetic, producing a garbage sensor value instead of
propagating the error.

Add the missing error check before using the return value.

Fixes: b64b6cb163f16 ("hwmon: Add driver for TI INA233 Current and Power Monitor")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
---
 drivers/hwmon/pmbus/ina233.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwmon/pmbus/ina233.c b/drivers/hwmon/pmbus/ina233.c
index dde1e16783943..2d8b5a5347edc 100644
--- a/drivers/hwmon/pmbus/ina233.c
+++ b/drivers/hwmon/pmbus/ina233.c
@@ -67,6 +67,8 @@ static int ina233_read_word_data(struct i2c_client *client, int page,
 	switch (reg) {
 	case PMBUS_VIRT_READ_VMON:
 		ret = pmbus_read_word_data(client, 0, 0xff, MFR_READ_VSHUNT);
+		if (ret < 0)
+			return ret;
 
 		/* Adjust returned value to match VIN coefficients */
 		/* VIN: 1.25 mV VSHUNT: 2.5 uV LSB */
-- 
2.34.1

[PATCH 5/5] hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@juniper.net>

isl68137_avs_enable_show_page() uses the return value of
pmbus_read_byte_data() without checking for errors. If the I2C transaction
fails, the negative error code is passed through the bitmask test and
sprintf, producing incorrect output instead of propagating the error.

Additionally, replace sprintf() with sysfs_emit() which is the preferred
API for sysfs show callbacks since v5.10.

Fixes: 038a9c3d1e424 ("hwmon: (pmbus/isl68137) Add driver for Intersil ISL68137 PWM Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
---
 drivers/hwmon/pmbus/isl68137.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/isl68137.c b/drivers/hwmon/pmbus/isl68137.c
index 97b61836f53a4..739e7126be51c 100644
--- a/drivers/hwmon/pmbus/isl68137.c
+++ b/drivers/hwmon/pmbus/isl68137.c
@@ -98,8 +98,11 @@ static ssize_t isl68137_avs_enable_show_page(struct i2c_client *client,
 {
 	int val = pmbus_read_byte_data(client, page, PMBUS_OPERATION);
 
-	return sprintf(buf, "%d\n",
-		       (val & ISL68137_VOUT_AVS) == ISL68137_VOUT_AVS ? 1 : 0);
+	if (val < 0)
+		return val;
+
+	return sysfs_emit(buf, "%d\n",
+			  !!(val & ISL68137_VOUT_AVS));
 }
 
 static ssize_t isl68137_avs_enable_store_page(struct i2c_client *client,
-- 
2.34.1

Re: [PATCH 4/5] hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value

[Guenter Roeck]

On Tue, Mar 17, 2026 at 05:46:31PM +0000, Pradhan, Sanman wrote:
> From: Sanman Pradhan <psanman@juniper.net>
> 
> ina233_read_word_data() uses the return value of pmbus_read_word_data()
> directly in a DIV_ROUND_CLOSEST() computation without first checking for
> errors. If the underlying I2C transaction fails, a negative error code is
> used in the arithmetic, producing a garbage sensor value instead of
> propagating the error.
> 
> Add the missing error check before using the return value.
> 
> Fixes: b64b6cb163f16 ("hwmon: Add driver for TI INA233 Current and Power Monitor")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sanman Pradhan <psanman@juniper.net>

Applied.

Thanks,
Guenter

Re: [PATCH 0/5] hwmon: (pmbus) Fix unchecked error returns in multiple drivers

[Guenter Roeck]

On Tue, Mar 17, 2026 at 05:36:33PM +0000, Pradhan, Sanman wrote:
> From: Sanman Pradhan <psanman@juniper.net>
> 
> Several PMBus device drivers use the return value of pmbus_read_word_data()
> or pmbus_read_byte_data() in arithmetic, bitwise, or macro operations
> without first checking for a negative error code. If the underlying I2C
> transaction fails, the negative errno propagates into FIELD_GET(),
> FIELD_PREP(), XOR, or DIV_ROUND_CLOSEST operations, silently producing
> corrupted sensor or status data instead of reporting the error.
> 
AI review feedback is at 
https://sashiko.dev/#/patchset/20260317174553.385567-1-sanman.pradhan%40hpe.com

One of the drivers (see patch 4 feedback) has an unrelated problem, for which
I would appreciate a fix, but patch 5/5 is making a wrong functional change
which needs to be fixed.

I'll apply patches 1..4 of the series.

Thanks,
Guenter

> Sanman Pradhan (5):
>   hwmon: (pmbus/hac300s) Add error check for pmbus_read_word_data()
>     return value
>   hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data()
>     return value
>   hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its
>     return value
>   hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data()
>     return value
>   hwmon: (pmbus/isl68137) Fix unchecked return value and use
>     sysfs_emit()
> 
>  drivers/hwmon/pmbus/hac300s.c  |  2 ++
>  drivers/hwmon/pmbus/ina233.c   |  2 ++
>  drivers/hwmon/pmbus/isl68137.c |  7 +++++--
>  drivers/hwmon/pmbus/mp2869.c   | 35 ++++++++++++++++++++--------------
>  drivers/hwmon/pmbus/mp2975.c   |  2 ++
>  5 files changed, 32 insertions(+), 16 deletions(-)
> 
> -- 
> 2.34.1
> 
>