Re: [PATCH 3/3] hwmon: ltc2978: Document LT7175 and LT7176P support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] hwmon: (pmbus/ltc2978) uninitialized stack read in ltc2978_get_id()
- [Low] hwmon: ltc2978: incorrect curr1_label documentation for LT7175 and LT7176P
--

commit 920a8e47ce82192a2f0425722db911c23eb2b4ca
Author: Christopher de Guzman <christopher.deguzman@analog.com>

hwmon: ltc2978: Document LT7175 and LT7176P support

This commit documents support for the LT7175/LT7175-1 and LT7176P/LT7176P-1
PMBus buck regulators in the ltc2978 hwmon driver documentation, which were
added in commit 51707b022513 ("hwmon: (pmbus/ltc2978) Add support for LT7175
and LT7176P").

> diff --git a/Documentation/hwmon/ltc2978.rst b/Documentation/hwmon/ltc2978.rst
> index 0b72d566cac70..3d30ce5cac95d 100644
> --- a/Documentation/hwmon/ltc2978.rst
> +++ b/Documentation/hwmon/ltc2978.rst
> @@ -21,6 +21,22 @@ Supported chips:
>  
>      Datasheet: https://www.analog.com/en/products/lt7171.html
>  
> +  * Analog Devices LT7175, LT7175-1
> +
> +    Prefix: 'lt7175'
> +
> +    Addresses scanned: -
> +
> +    Datasheet: https://www.analog.com/en/products/lt7175
> +
> +  * Analog Devices LT7176P, LT7176P-1
> +
> +    Prefix: 'lt7176p'
> +
> +    Addresses scanned: -
> +
> +    Datasheet: https://www.analog.com/en/products/lt7176p
> +

[Severity: Medium]
In the preceding commit 51707b022513 ("hwmon: (pmbus/ltc2978) Add support
for LT7175 and LT7176P"), can ltc2978_probe() -> ltc2978_get_id() in
drivers/hwmon/pmbus/ltc2978.c read an uninitialized byte from buf[6] on the
stack when checking for "LT7176P"?

In drivers/hwmon/pmbus/ltc2978.c:ltc2978_get_id():

	if ((chip_id & LTC2978_ID_MASK) == LT7170_ID) {
		u8 buf[I2C_SMBUS_BLOCK_MAX];

		ret = pmbus_read_smbus_i2c_block_data(client, PMBUS_IC_DEVICE_ID, buf);
		if (ret < 0)
			return ret;
		if (ret < 6)
			return -ENODEV;

		if (!strncmp(buf, "LT7170", 6))
			return lt7170;
		if (!strncmp(buf, "LT7171", 6))
			return lt7171;
		if (!strncmp(buf, "LT7175", 6))
			return lt7175;
		if (!strncmp(buf, "LT7176P", 7))
			return lt7176p;

pmbus_read_smbus_i2c_block_data() in drivers/hwmon/pmbus/pmbus_core.c copies
only ret bytes into buf without NUL-terminating it or initializing remaining
bytes.

Since the length check only enforces ret >= 6, if a device returns 6 bytes
with buf[0..5] containing "LT7176", strncmp(buf, "LT7176P", 7) will read the
uninitialized 7th byte at buf[6]. Should the "LT7176P" check verify ret >= 7
first?

[ ... ]

> @@ -432,9 +450,9 @@ power[N]_input		Measured output power.
>  
>  curr1_label		"iin".
>  
> -			LT7170, LT7171, LTC3880, LTC3883, LTC3884, LTC3886,
> -			LTC3887, LTC3889, LTM4644, LTM4675, LTM4676, LTM4677,
> -			LTM4678, LTM4680, and LTM4700 only.
> +			LT7170, LT7171, LT7175, LT7176P, LTC3880, LTC3883,
> +			LTC3884, LTC3886, LTC3887, LTC3889, LTM4644, LTM4675,
> +			LTM4676, LTM4677, LTM4678, LTM4680, and LTM4700 only.
>  
>  curr1_input		Measured input current.
>  
> @@ -452,7 +470,7 @@ curr1_reset_history	Reset input current history.
>  
>  curr[N]_label		"iout[1-4]".
>  
> -			- LT7170, LT7171: N=1
> +			- LT7170, LT7171, LT7175, LT7176P: N=1

[Severity: Low]
Should LT7175 and LT7176P be omitted from the curr1_label "iin" list above?

In drivers/hwmon/pmbus/ltc2978.c:ltc2978_probe(), the lt7175 and lt7176p
configuration sets:

	case lt7175:
	case lt7176p:
		...
		info->func[0] = PMBUS_HAVE_VIN | PMBUS_HAVE_STATUS_INPUT
		  | PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT
		  | PMBUS_HAVE_IOUT | PMBUS_HAVE_STATUS_IOUT
		  | PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP;
		break;

Because PMBUS_HAVE_IIN is not enabled for these chips, curr1 is "iout1" (as
documented in the curr[N]_label N=1 entry) rather than "iin".

>  			- LTC2972: N-1-2
>  			- LTC2974, LTC2975: N=1-4
>  			- LTC2977, LTC2979, LTC2980, LTM2987: not supported

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261020-upstream-lt7175-lt7176p-v1-0-86b9b728b95d@analog.com?part=3