lkml.org 
[lkml]   [2026]   [Apr]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH v2 0/3] hwmon: Fix bugs in pt5161l, isl28022, and powerz
Date
From: Sanman Pradhan <psanman@juniper.net>

This series fixes bugs in drivers/hwmon/

1. pt5161l: Undersized stack buffer for SMBus block read, and
unexpected positive return when retries are exhausted
2. isl28022: Integer overflow in power calculation on 32-bit
3. powerz: Use-after-free race on USB disconnect, and signal
handling bug in completion wait

Changes since v1:
- Patch 1/3 (pt5161l): Also fix the case where
i2c_smbus_read_block_data() returns a positive byte count on
length mismatch after all retries are exhausted. Callers treated
this as success. Return -EIO instead.
- Patch 2/3 (isl28022): Switch from s64/div_s64() to u64/div_u64()
since power is inherently non-negative. This avoids implicit
narrowing of the u32 shunt divisor to s32.
- Patch 3/3 (powerz): Also fix signal handling in
wait_for_completion_interruptible_timeout(). The original code
only handles timeout (ret==0) but not signals (ret==-ERESTARTSYS),
which skips usb_kill_urb() and falls through to access stale URB
data. Return -ENODEV instead of -EIO on disconnected device for
clearer semantics.

Sanman Pradhan (3):
hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit
hwmon: (powerz) Fix use-after-free and signal handling on USB
disconnect

drivers/hwmon/isl28022.c | 7 +++++--
drivers/hwmon/powerz.c | 18 +++++++++++++-----
drivers/hwmon/pt5161l.c | 4 ++--
3 files changed, 20 insertions(+), 9 deletions(-)

--
2.34.1


\
 
 \ /
  Last update: 2026-04-07 19:41    [W:0.103 / U:0.422 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog