linux-kernel - Re: [PATCH v2 2/2] hwmon: add MP2925 and MP2929 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ae5ad599-e857-4124-b6a0-61196a763109@roeck-us.net>
Date: Thu, 25 Sep 2025 08:07:55 -0700
From: Guenter Roeck <linux@...ck-us.net>
To: wenswang@...h.net
Cc: robh@...nel.org, krzk+dt@...nel.org, conor+dt@...nel.org,
	jdelvare@...e.com, corbet@....net, devicetree@...r.kernel.org,
	linux-kernel@...r.kernel.org, linux-hwmon@...r.kernel.org,
	linux-doc@...r.kernel.org
Subject: Re: [PATCH v2 2/2] hwmon: add MP2925 and MP2929 driver

On Thu, Sep 18, 2025 at 04:06:03PM +0800, wenswang@...h.net wrote:
> From: Wensheng Wang <wenswang@...h.net>
> 
> Add support for MPS VR mp2925 and mp2929 controller. This driver exposes
> telemetry and limit value readings and writtings.
> 
> Signed-off-by: Wensheng Wang <wenswang@...h.net>

I'll have to drop this series. Reason:

> --- /dev/null
> +++ b/drivers/hwmon/pmbus/mp2925.c
...
> +
> +static int mp2925_write_word_data(struct i2c_client *client, int page, int reg,
> +				  u16 word)
> +{
> +	int ret;
> +
> +	switch (reg) {
> +	case PMBUS_VIN_OV_FAULT_LIMIT:
> +	case PMBUS_VIN_OV_WARN_LIMIT:
> +	case PMBUS_VIN_UV_WARN_LIMIT:
> +	case PMBUS_VIN_UV_FAULT_LIMIT:
> +		/*
> +		 * The PMBUS_VIN_OV_FAULT_LIMIT, PMBUS_VIN_OV_WARN_LIMIT,
> +		 * PMBUS_VIN_UV_WARN_LIMIT and PMBUS_VIN_UV_FAULT_LIMIT
> +		 * of MP2925 is linear11 format, and the exponent is a
> +		 * constant value(5'b11100)， so the exponent of word
> +		 * parameter should be converted to 5'b11100(0x1C).
> +		 */
> +		ret = pmbus_write_word_data(client, page, reg,
> +					    mp2925_linear_exp_transfer(word, 0x1C));
> +		if (ret < 0)
> +			return ret;
> +		break;
> +	case PMBUS_VOUT_OV_FAULT_LIMIT:
> +	case PMBUS_VOUT_UV_FAULT_LIMIT:
> +		ret = pmbus_write_word_data(client, page, reg,
> +					    (ret & ~GENMASK(11, 0)) |
                                             ^^^

As 0-day rightfully reports, ret is not initialized here. Datasheets for both chips
are not published (actually the chips don't officially exist), so I can not figure out
the expected behavior myself. FWIW, available datasheets suggest that the bits are unused,
so if that is not correct please provide evidence that writing anything but 0 into those
bits is needed.

While at it, please also provide evidence that the chips exist in the first place
and that this is not a "let's see what he accepts" submission.

Guenter