linux-stable.git/drivers/hwmon, branch linux-rolling-stable

hwmon: occ: validate poll response sensor blocks

2026-08-03T09:25:30+00:00

[ Upstream commit 70e76e700fc6c46afb4e17aec099a1ea089b4a22 ]

The OCC poll response parser walks a counted list of sensor data blocks.
It used the static backing-array capacity as the parse boundary, but a
transport response makes only data_length bytes current and valid. A
truncated response can therefore make the parser consume a block header or
block extent outside the current response.

Use data_length as the parent boundary, prove the fixed poll header and
each current block header before reading them, and prove the complete block
before advancing. Keep parsed sensor metadata local until the complete
response has passed validation, then publish it. Propagate
malformed-response errors before publishing the OCC as active.

Fixes: aa195fe49b03 ("hwmon (occ): Parse OCC poll response")
Signed-off-by: Pengpeng Hou 
Link: https://lore.kernel.org/r/20260720115826.14813-1-pengpeng@iscas.ac.cn
Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin

hwmon: (asus-ec-sensors) add missed handle for ENOMEM

2026-08-03T09:25:29+00:00

[ Upstream commit 9813c1f49efeadbcb17e4a41972350ac783f9cac ]

Add missing return value check in the setup function.

Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC")
Signed-off-by: Eugene Shalygin 
Link: https://lore.kernel.org/r/20260712130602.1256700-2-eugene.shalygin@gmail.com
Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin

hwmon: (asus-ec-sensors) fix EC read intervals

2026-08-03T09:25:29+00:00

[ Upstream commit 60710b2af13b81da71b429d3f8b19dd70310729d ]

Take INITIAL_JIFFIES into account when setting up next update time.

Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC")
Signed-off-by: Eugene Shalygin 
Link: https://lore.kernel.org/r/20260712110650.1240071-2-eugene.shalygin@gmail.com
Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin

hwmon: (asus-ec-sensors) fix looping over banks while reading from EC

2026-08-03T09:25:29+00:00

[ Upstream commit e741d13cc2abfc6fccebe2008057aa52e285223e ]

Do not assume there are only bank 0 and bank 1 available, just use '!='
for bank comparison.

Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC")
Signed-off-by: Eugene Shalygin 
Link: https://lore.kernel.org/r/20260711074217.554656-1-eugene.shalygin@gmail.com
Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin

hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers

2026-08-03T09:25:29+00:00

[ Upstream commit af01dab0c39a7aefc47a109201e4134ea6bd3005 ]

MAX34451 and ADPM chips do not support standard PMBus VIN/IIN limit
registers, manufacturer specific min/max registers, or undercurrent
or undertemperature fault limits. STATUS_BYTE and STATUS_OTHER are also
not available. Accessing these non-existent registers during driver
initialization triggers a CML error and asserts ALERT. Handled by
blocking these functions during read/write.

Fixes: 7a001dbab4ad ("hwmon: (pmbus/max34440) Add support for MAX34451.")
Fixes: 629cf8f6c23a ("hwmon: (pmbus/max34440) Add support for ADPM12160")
Fixes: 2e0b52f1ae88 ("hwmon: (pmbus/max34440): add support adpm12200")
Fixes: 479bfeba2eb6 ("hwmon: (pmbus/max34440): add support adpm12250")
Signed-off-by: Alexis Czezar Torreno 
Link: https://lore.kernel.org/r/20260716-max34451_fixes-v1-1-a941b27eaecb@analog.com
Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin

hwmon: (pmbus/max34440): add support adpm12250

2026-08-03T09:25:29+00:00

[ Upstream commit 479bfeba2eb62666cd4b981c8e721c61dcf36e7d ]

ADPM12250 is a quarter brick DC/DC Power Module. It is a high power
non-isolated converter capable of delivering regulated 12V with
continuous power level of 2500W. Uses PMBus.

Signed-off-by: Alexis Czezar Torreno 
Reviewed-by: Nuno Sá 
Link: https://lore.kernel.org/r/20260610-dev-adpm12250-v1-1-422760bb80da@analog.com
Signed-off-by: Guenter Roeck 
Stable-dep-of: af01dab0c39a ("hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers")
Signed-off-by: Sasha Levin

hwmon: Use named initializers for arrays of i2c_device_data

2026-08-03T09:25:29+00:00

[ Upstream commit 4a9e6a9230c88a71916301b9fe6627413ebc2574 ]

While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.

While touching all these arrays, unify indention and usage of commas.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.

Signed-off-by: Uwe Kleine-König (The Capable Hub) 
Link: https://lore.kernel.org/r/65b77bcd452752c36d866069cc5790b26d2bf8dc.1778688803.git.u.kleine-koenig@baylibre.com
Signed-off-by: Guenter Roeck 
Stable-dep-of: af01dab0c39a ("hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers")
Signed-off-by: Sasha Levin

hwmon: Drop unused i2c driver_data

2026-08-03T09:25:29+00:00

[ Upstream commit b3de407ae66ffef6290a31363205e9751db0537a ]

The four drivers all don't make use of the value that was explicitly
assigned to the .driver_data member. Drop the assignment.

While touching these lines also make the assignments use named
initializers and drop a comma after the end-of-list marker.

Signed-off-by: Uwe Kleine-König (The Capable Hub) 
Reviewed-by: Chris Packham  # For
Link: https://lore.kernel.org/r/e8ceb3931975813545a8b478cc1a71b4ede9a6c0.1778688803.git.u.kleine-koenig@baylibre.com
Signed-off-by: Guenter Roeck 
Stable-dep-of: af01dab0c39a ("hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers")
Signed-off-by: Sasha Levin

hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop

2026-08-03T09:25:26+00:00

[ Upstream commit f151d0143ac4e086f92f52328ebdbdc50933d8ef ]

Calling hid_hw_stop() does not stop the device IO.
This results in a race condition between hid_input_report() and the point
immediately following the execution of hid_device_io_start() within
the driver probe function. If the probe operation fails after "io start"
has been initiated, this race condition will result in a UAF vulnerability.

Fix the problem by calling hid_device_io_stop() before calling
hid_hw_stop().

Reported-by: Sashiko 
Fixes: f3b4b146eb107 ("hwmon: Add driver for NZXT Kraken X and Z series AIO CPU coolers")
Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin

hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop

2026-08-03T09:25:26+00:00

[ Upstream commit 59d104b54b0b42e30fd2a68d24ee5c49dcc54d1e ]

Calling hid_hw_stop() does not stop the device IO.
This results in a race condition between hid_input_report() and the point
immediately following the execution of hid_device_io_start() within
the driver probe function. If the probe operation fails after "io start"
has been initiated, this race condition will result in a UAF vulnerability.

Fix the problem by calling hid_device_io_stop() before calling
hid_hw_stop().

Reported-by: Sashiko 
Fixes: 53e68c20aeb1e ("hwmon: add driver for NZXT RGB&Fan Controller/Smart Device v2")
Signed-off-by: Guenter Roeck 
Signed-off-by: Sasha Levin