re: hwmon: add MP2925 and MP2929 driver

re: hwmon: add MP2925 and MP2929 driver

[Colin King (gmail)]

[-- Attachment #1.1.1: Type: text/plain, Size: 953 bytes --]

Hi,

Static analysis on linux-next has found an issue in function 
mp2925_write_word_data with the following commit:

commit b3a4efc88601cb5fc97b4ae23c478700a60302da
Author: Wensheng Wang <wenswang@yeah.net>
Date:   Thu Sep 18 16:06:03 2025 +0800

     hwmon: add MP2925 and MP2929 driver


The issue is as follows:

         case PMBUS_VOUT_OV_FAULT_LIMIT:
         case PMBUS_VOUT_UV_FAULT_LIMIT:
                 ret = pmbus_write_word_data(client, page, reg,
                                             (ret & ~GENMASK(11, 0)) |
                                 FIELD_PREP(GENMASK(11, 0),
                                            DIV_ROUND_CLOSEST(word * 
MP2925_VOUT_OVUV_DIV,
  
MP2925_VOUT_OVUV_UINT)));
                 break;

The call to pmbus_write_word_data() is accessing variable ret via the 
mask ~GENMASK(11, 0) however at this point ret has not been initialized 
so it contains a garbage value.

Colin

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 4901 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

Re: hwmon: add MP2925 and MP2929 driver

[Guenter Roeck]

On 9/26/25 07:17, Colin King (gmail) wrote:
> Hi,
> 
> Static analysis on linux-next has found an issue in function mp2925_write_word_data with the following commit:
> 
> commit b3a4efc88601cb5fc97b4ae23c478700a60302da
> Author: Wensheng Wang <wenswang@yeah.net>
> Date:   Thu Sep 18 16:06:03 2025 +0800
> 
>      hwmon: add MP2925 and MP2929 driver
> 
> 
> The issue is as follows:
> 
>          case PMBUS_VOUT_OV_FAULT_LIMIT:
>          case PMBUS_VOUT_UV_FAULT_LIMIT:
>                  ret = pmbus_write_word_data(client, page, reg,
>                                              (ret & ~GENMASK(11, 0)) |
>                                  FIELD_PREP(GENMASK(11, 0),
>                                             DIV_ROUND_CLOSEST(word * MP2925_VOUT_OVUV_DIV,
> 
> MP2925_VOUT_OVUV_UINT)));
>                  break;
> 
> The call to pmbus_write_word_data() is accessing variable ret via the mask ~GENMASK(11, 0) however at this point ret has not been initialized so it contains a garbage value.
> 

Yes, that was also reported by 0-day. Patches now dropped from linux-next since I can not
figure out the intended use (datasheets are not public, or, rather, the chips don't even
officially exist).

Guenter