linux-kernel - Re: hwmon: add MP2925 and MP2929 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1ac6f9ac-ff6e-4276-a6d6-c3f115db9b8a@roeck-us.net>
Date: Fri, 26 Sep 2025 09:12:51 -0700
From: Guenter Roeck <linux@...ck-us.net>
To: "Colin King (gmail)" <colin.i.king@...il.com>,
 Wensheng Wang <wenswang@...h.net>, linux-hwmon@...r.kernel.org
Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: hwmon: add MP2925 and MP2929 driver

On 9/26/25 07:17, Colin King (gmail) wrote:
> Hi,
> 
> Static analysis on linux-next has found an issue in function mp2925_write_word_data with the following commit:
> 
> commit b3a4efc88601cb5fc97b4ae23c478700a60302da
> Author: Wensheng Wang <wenswang@...h.net>
> Date:   Thu Sep 18 16:06:03 2025 +0800
> 
>      hwmon: add MP2925 and MP2929 driver
> 
> 
> The issue is as follows:
> 
>          case PMBUS_VOUT_OV_FAULT_LIMIT:
>          case PMBUS_VOUT_UV_FAULT_LIMIT:
>                  ret = pmbus_write_word_data(client, page, reg,
>                                              (ret & ~GENMASK(11, 0)) |
>                                  FIELD_PREP(GENMASK(11, 0),
>                                             DIV_ROUND_CLOSEST(word * MP2925_VOUT_OVUV_DIV,
> 
> MP2925_VOUT_OVUV_UINT)));
>                  break;
> 
> The call to pmbus_write_word_data() is accessing variable ret via the mask ~GENMASK(11, 0) however at this point ret has not been initialized so it contains a garbage value.
> 

Yes, that was also reported by 0-day. Patches now dropped from linux-next since I can not
figure out the intended use (datasheets are not public, or, rather, the chips don't even
officially exist).

Guenter