[PATCH v2 0/1] hwmon: (asus-ec-sensors) fix EC read intervals

[PATCH v2 0/1] hwmon: (asus-ec-sensors) fix EC read intervals

[Eugene Shalygin]

v2: revret updating `state->next_update` before the update_ec_sensors()
call.

Eugene Shalygin (1):
  hwmon: (asus-ec-sensors) fix EC read intervals

 drivers/hwmon/asus-ec-sensors.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

-- 
2.55.0

[PATCH v2 1/1] hwmon: (asus-ec-sensors) fix EC read intervals

[Eugene Shalygin]

Take INITIAL_JIFFIES into account when setting up next update time.

Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>

Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC")
---
 drivers/hwmon/asus-ec-sensors.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
index 29a23484cbe7..eb71e41fd4f4 100644
--- a/drivers/hwmon/asus-ec-sensors.c
+++ b/drivers/hwmon/asus-ec-sensors.c
@@ -1009,7 +1009,7 @@ struct ec_sensors_data {
 	/* sorted list of unique register banks */
 	u8 banks[ASUS_EC_MAX_BANK + 1];
 	/* in jiffies */
-	unsigned long last_updated;
+	u64 next_update;
 	struct lock_data lock_data;
 	/* number of board EC sensors */
 	u8 nr_sensors;
@@ -1278,13 +1278,12 @@ static int get_cached_value_or_update(const struct device *dev,
 				      int sensor_index,
 				      struct ec_sensors_data *state, s32 *value)
 {
-	if (time_after(jiffies, state->last_updated + HZ)) {
+	if (time_after64(get_jiffies_64(), state->next_update)) {
 		if (update_ec_sensors(dev, state)) {
 			dev_err(dev, "update_ec_sensors() failure\n");
 			return -EIO;
 		}
-
-		state->last_updated = jiffies;
+		state->next_update = get_jiffies_64() + HZ;
 	}
 
 	*value = state->sensors[sensor_index].cached_value;
@@ -1402,6 +1401,7 @@ static int asus_ec_probe(struct platform_device *pdev)
 	if (!ec_data)
 		return -ENOMEM;
 
+	ec_data->next_update = INITIAL_JIFFIES;
 	dev_set_drvdata(dev, ec_data);
 	ec_data->board_info = pboard_info;
 
-- 
2.55.0

Re: [PATCH v2 1/1] hwmon: (asus-ec-sensors) fix EC read intervals

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver ignores the memory allocation failure from asus_ec_hwmon_add_chan_info(), causing a NULL pointer dereference in the hwmon core.
- [High] Missing rate-limiting timestamp update on EC read failure allows log flooding and ACPI EC spam by unprivileged userspace.
--

--- Patch [1]: [PATCH v2 1/1] hwmon: (asus-ec-sensors) fix EC read intervals ---
commit 22e0613e28eceb6562850cc438cb81f20f1fefaa
Author: Eugene Shalygin <eugene.shalygin@gmail.com>

hwmon: (asus-ec-sensors) fix EC read intervals

This commit updates the EC read interval logic to take INITIAL_JIFFIES into
account when setting up the next update time, using a 64-bit jiffies value
for next_update.

> diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
> index 29a23484cbe7b..eb71e41fd4f4b 100644
> --- a/drivers/hwmon/asus-ec-sensors.c
> +++ b/drivers/hwmon/asus-ec-sensors.c

[ ... ]

> @@ -1278,13 +1278,12 @@ static int get_cached_value_or_update(const struct device *dev,
>  				      int sensor_index,
>  				      struct ec_sensors_data *state, s32 *value)
>  {
> -	if (time_after(jiffies, state->last_updated + HZ)) {
> +	if (time_after64(get_jiffies_64(), state->next_update)) {
>  		if (update_ec_sensors(dev, state)) {
>  			dev_err(dev, "update_ec_sensors() failure\n");
>  			return -EIO;
>  		}

[Severity: High]
This is a pre-existing issue, but does returning early on error here cause
unbounded log spam?

If update_ec_sensors() fails (e.g., due to a hardware timeout), it returns
-EIO without updating state->next_update. Since the timestamp remains in the
past, subsequent reads from userspace will immediately retry the failing
operation, potentially spamming the log and the ACPI EC.

Should state->next_update be advanced even on failure to maintain rate
limiting?

> -
> -		state->last_updated = jiffies;
> +		state->next_update = get_jiffies_64() + HZ;
>  	}
>  
>  	*value = state->sensors[sensor_index].cached_value;

[ ... ]

> @@ -1488,8 +1488,8 @@ static int asus_ec_probe(struct platform_device *pdev)
>  	for (type = 0; type < hwmon_max; ++type) {
>  		if (!nr_count[type])
>  			continue;
>  
>  		asus_ec_hwmon_add_chan_info(asus_ec_hwmon_chan, dev,
>  					     nr_count[type], type,
>  					     hwmon_attributes[type]);
>  		*ptr_asus_ec_ci++ = asus_ec_hwmon_chan++;
>  	}

[Severity: High]
This isn't a bug introduced by this patch, but does this loop ignore memory
allocation failures?

If devm_kcalloc() fails inside asus_ec_hwmon_add_chan_info(), it returns
-ENOMEM and leaves asus_ec_hwmon_chan->config as NULL.

Since the return value is ignored here, the uninitialized struct is passed
to devm_hwmon_device_register_with_info(). The hwmon core unconditionally
dereferences the config pointer in hwmon_num_channel_attrs(), which could
cause a kernel oops on probe during memory pressure.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260712110650.1240071-2-eugene.shalygin@gmail.com?part=1