* Re: [PATCH v2 1/1] hwmon: (asus-ec-sensors) fix EC read intervals
2026-07-12 11:05 ` [PATCH v2 1/1] " Eugene Shalygin
@ 2026-07-12 11:16 ` sashiko-bot
0 siblings, 0 replies; 3+ messages in thread
From: sashiko-bot @ 2026-07-12 11:16 UTC (permalink / raw)
To: Eugene Shalygin; +Cc: linux-hwmon
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] The driver ignores the memory allocation failure from asus_ec_hwmon_add_chan_info(), causing a NULL pointer dereference in the hwmon core.
- [High] Missing rate-limiting timestamp update on EC read failure allows log flooding and ACPI EC spam by unprivileged userspace.
--
--- Patch [1]: [PATCH v2 1/1] hwmon: (asus-ec-sensors) fix EC read intervals ---
commit 22e0613e28eceb6562850cc438cb81f20f1fefaa
Author: Eugene Shalygin <eugene.shalygin@gmail.com>
hwmon: (asus-ec-sensors) fix EC read intervals
This commit updates the EC read interval logic to take INITIAL_JIFFIES into
account when setting up the next update time, using a 64-bit jiffies value
for next_update.
> diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
> index 29a23484cbe7b..eb71e41fd4f4b 100644
> --- a/drivers/hwmon/asus-ec-sensors.c
> +++ b/drivers/hwmon/asus-ec-sensors.c
[ ... ]
> @@ -1278,13 +1278,12 @@ static int get_cached_value_or_update(const struct device *dev,
> int sensor_index,
> struct ec_sensors_data *state, s32 *value)
> {
> - if (time_after(jiffies, state->last_updated + HZ)) {
> + if (time_after64(get_jiffies_64(), state->next_update)) {
> if (update_ec_sensors(dev, state)) {
> dev_err(dev, "update_ec_sensors() failure\n");
> return -EIO;
> }
[Severity: High]
This is a pre-existing issue, but does returning early on error here cause
unbounded log spam?
If update_ec_sensors() fails (e.g., due to a hardware timeout), it returns
-EIO without updating state->next_update. Since the timestamp remains in the
past, subsequent reads from userspace will immediately retry the failing
operation, potentially spamming the log and the ACPI EC.
Should state->next_update be advanced even on failure to maintain rate
limiting?
> -
> - state->last_updated = jiffies;
> + state->next_update = get_jiffies_64() + HZ;
> }
>
> *value = state->sensors[sensor_index].cached_value;
[ ... ]
> @@ -1488,8 +1488,8 @@ static int asus_ec_probe(struct platform_device *pdev)
> for (type = 0; type < hwmon_max; ++type) {
> if (!nr_count[type])
> continue;
>
> asus_ec_hwmon_add_chan_info(asus_ec_hwmon_chan, dev,
> nr_count[type], type,
> hwmon_attributes[type]);
> *ptr_asus_ec_ci++ = asus_ec_hwmon_chan++;
> }
[Severity: High]
This isn't a bug introduced by this patch, but does this loop ignore memory
allocation failures?
If devm_kcalloc() fails inside asus_ec_hwmon_add_chan_info(), it returns
-ENOMEM and leaves asus_ec_hwmon_chan->config as NULL.
Since the return value is ignored here, the uninitialized struct is passed
to devm_hwmon_device_register_with_info(). The hwmon core unconditionally
dereferences the config pointer in hwmon_num_channel_attrs(), which could
cause a kernel oops on probe during memory pressure.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260712110650.1240071-2-eugene.shalygin@gmail.com?part=1
^ permalink raw reply [flat|nested] 3+ messages in thread