linux-kernel - [PATCH AUTOSEL 6.16-6.12] regulator: pm8008: fix probe failure due to negative voltage selector

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250902120833.1342615-11-sashal@kernel.org>
Date: Tue,  2 Sep 2025 08:08:22 -0400
From: Sasha Levin <sashal@...nel.org>
To: patches@...ts.linux.dev,
	stable@...r.kernel.org
Cc: Kamal Wadhwa <kamal.wadhwa@....qualcomm.com>,
	Mark Brown <broonie@...nel.org>,
	Sasha Levin <sashal@...nel.org>,
	lgirdwood@...il.com,
	linux-arm-msm@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH AUTOSEL 6.16-6.12] regulator: pm8008: fix probe failure due to negative voltage selector

From: Kamal Wadhwa <kamal.wadhwa@....qualcomm.com>

[ Upstream commit ef3e9c91ed87f13dba877a20569f4a0accf0612c ]

In the current design, the `pm8008_regulator_get_voltage_sel()` callback
can return a negative value if the raw voltage value is read as 0 uV from
the PMIC HW register. This can cause the probe to fail when the
`machine_constraints_voltage()` check is called during the regulator
registration flow.

Fix this by using the helper `regulator_map_voltage_linear_range()` to
convert the raw value to a voltage selector inside the mentioned get
voltage selector function. This ensures that the value returned is always
within the defined range.

Signed-off-by: Kamal Wadhwa <kamal.wadhwa@....qualcomm.com>
Message-ID: <20250823-pm8008-negitive-selector-v1-1-52b026a4b5e8@...cinc.com>
Signed-off-by: Mark Brown <broonie@...nel.org>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---

LLM Generated explanations, may be completely bogus:

**Backport Status: YES**

## Extensive Analysis:

This commit is a clear candidate for backporting to stable kernel trees
based on the following analysis:

### 1. **Bug Fix Nature**
The commit fixes a real probe failure bug in the pm8008 regulator
driver. Looking at the code change at line 99 (`drivers/regulator/qcom-
pm8008-regulator.c:99`), the original implementation had a mathematical
bug:
```c
// OLD (buggy):
return (uV - preg->desc.min_uV) / preg->desc.uV_step;

// NEW (fixed):
return regulator_map_voltage_linear_range(rdev, uV, INT_MAX);
```

### 2. **The Critical Bug**
The original code directly calculates the voltage selector using simple
arithmetic: `(uV - min_uV) / step`. When the hardware register returns 0
(which gets converted to 0 uV), this formula produces a **negative
value** because:
- For NLDO ranges: min_uV = 528000, so (0 - 528000) / 8000 = -66
- For PLDO ranges: min_uV = 1504000, so (0 - 1504000) / 8000 = -188

This negative selector value causes the regulator probe to fail during
`machine_constraints_voltage()` validation, making the entire PM8008
PMIC unusable.

### 3. **Small and Contained Fix**
The fix is minimal - just a single line change that replaces manual
calculation with a proper helper function. The
`regulator_map_voltage_linear_range()` helper properly validates the
voltage against the defined ranges and returns a valid selector or an
error code, preventing negative values.

### 4. **No Architectural Changes**
The fix doesn't introduce any new features or change the driver's
architecture. It simply corrects the voltage selector calculation to use
the proper regulator framework helper.

### 5. **Clear User Impact**
This bug prevents the PM8008 PMIC from initializing at all when the
hardware returns 0V initially. This is a complete failure scenario
affecting real devices like:
- Fairphone FP4 and FP5 (as seen in recent DT commits)
- Qualcomm SC8280XP X13s laptop

### 6. **Recently Introduced Driver**
The driver was only added in June 2024 (commit `11d861d227ed1`), making
this an early bug fix for a relatively new driver. The bug has existed
since the driver's introduction.

### 7. **Already Marked for Stable**
The commit message shows `[ Upstream commit ef3e9c91ed87...]` indicating
this has already been identified for stable backporting by maintainers.

### 8. **Meets Stable Criteria**
According to stable kernel rules, this fix perfectly qualifies because
it:
- Fixes a real bug that affects users (probe failure)
- Is small (1 line change)
- Has no risk of introducing new issues (uses standard helper)
- Fixes a regression (driver never worked with 0V register values)
- Is obviously correct (proper use of framework helper)

The fix is essential for devices using the PM8008 PMIC and should be
backported to all stable kernels that include the original driver
(v6.11+).

 drivers/regulator/qcom-pm8008-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/qcom-pm8008-regulator.c b/drivers/regulator/qcom-pm8008-regulator.c
index da017c1969d0c..90c78ee1c37bf 100644
--- a/drivers/regulator/qcom-pm8008-regulator.c
+++ b/drivers/regulator/qcom-pm8008-regulator.c
@@ -96,7 +96,7 @@ static int pm8008_regulator_get_voltage_sel(struct regulator_dev *rdev)

 	uV = le16_to_cpu(val) * 1000;

-	return (uV - preg->desc.min_uV) / preg->desc.uV_step;
+	return regulator_map_voltage_linear_range(rdev, uV, INT_MAX);
 }

 static const struct regulator_ops pm8008_regulator_ops = {
-- 
2.50.1