Messages in this thread |  | | From | "Pradhan, Sanman" <> | | Subject | [PATCH v2 0/3] hwmon: Fix bugs in pt5161l, isl28022, and powerz | | Date | Tue, 7 Apr 2026 17:37:08 +0000 |
| |
From: Sanman Pradhan <psanman@juniper.net>
This series fixes bugs in drivers/hwmon/
1. pt5161l: Undersized stack buffer for SMBus block read, and unexpected positive return when retries are exhausted 2. isl28022: Integer overflow in power calculation on 32-bit 3. powerz: Use-after-free race on USB disconnect, and signal handling bug in completion wait
Changes since v1: - Patch 1/3 (pt5161l): Also fix the case where i2c_smbus_read_block_data() returns a positive byte count on length mismatch after all retries are exhausted. Callers treated this as success. Return -EIO instead. - Patch 2/3 (isl28022): Switch from s64/div_s64() to u64/div_u64() since power is inherently non-negative. This avoids implicit narrowing of the u32 shunt divisor to s32. - Patch 3/3 (powerz): Also fix signal handling in wait_for_completion_interruptible_timeout(). The original code only handles timeout (ret==0) but not signals (ret==-ERESTARTSYS), which skips usb_kill_urb() and falls through to access stale URB data. Return -ENODEV instead of -EIO on disconnected device for clearer semantics.
Sanman Pradhan (3): hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit hwmon: (powerz) Fix use-after-free and signal handling on USB disconnect
drivers/hwmon/isl28022.c | 7 +++++-- drivers/hwmon/powerz.c | 18 +++++++++++++----- drivers/hwmon/pt5161l.c | 4 ++-- 3 files changed, 20 insertions(+), 9 deletions(-)
-- 2.34.1
|  |