Re: [PATCH v2 1/1] hwmon: (asus-ec-sensors) fix EC read intervals

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver ignores the memory allocation failure from asus_ec_hwmon_add_chan_info(), causing a NULL pointer dereference in the hwmon core.
- [High] Missing rate-limiting timestamp update on EC read failure allows log flooding and ACPI EC spam by unprivileged userspace.
--

--- Patch [1]: [PATCH v2 1/1] hwmon: (asus-ec-sensors) fix EC read intervals ---
commit 22e0613e28eceb6562850cc438cb81f20f1fefaa
Author: Eugene Shalygin <eugene.shalygin@gmail.com>

hwmon: (asus-ec-sensors) fix EC read intervals

This commit updates the EC read interval logic to take INITIAL_JIFFIES into
account when setting up the next update time, using a 64-bit jiffies value
for next_update.

> diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
> index 29a23484cbe7b..eb71e41fd4f4b 100644
> --- a/drivers/hwmon/asus-ec-sensors.c
> +++ b/drivers/hwmon/asus-ec-sensors.c

[ ... ]

> @@ -1278,13 +1278,12 @@ static int get_cached_value_or_update(const struct device *dev,
>  				      int sensor_index,
>  				      struct ec_sensors_data *state, s32 *value)
>  {
> -	if (time_after(jiffies, state->last_updated + HZ)) {
> +	if (time_after64(get_jiffies_64(), state->next_update)) {
>  		if (update_ec_sensors(dev, state)) {
>  			dev_err(dev, "update_ec_sensors() failure\n");
>  			return -EIO;
>  		}

[Severity: High]
This is a pre-existing issue, but does returning early on error here cause
unbounded log spam?

If update_ec_sensors() fails (e.g., due to a hardware timeout), it returns
-EIO without updating state->next_update. Since the timestamp remains in the
past, subsequent reads from userspace will immediately retry the failing
operation, potentially spamming the log and the ACPI EC.

Should state->next_update be advanced even on failure to maintain rate
limiting?

> -
> -		state->last_updated = jiffies;
> +		state->next_update = get_jiffies_64() + HZ;
>  	}
>  
>  	*value = state->sensors[sensor_index].cached_value;

[ ... ]

> @@ -1488,8 +1488,8 @@ static int asus_ec_probe(struct platform_device *pdev)
>  	for (type = 0; type < hwmon_max; ++type) {
>  		if (!nr_count[type])
>  			continue;
>  
>  		asus_ec_hwmon_add_chan_info(asus_ec_hwmon_chan, dev,
>  					     nr_count[type], type,
>  					     hwmon_attributes[type]);
>  		*ptr_asus_ec_ci++ = asus_ec_hwmon_chan++;
>  	}

[Severity: High]
This isn't a bug introduced by this patch, but does this loop ignore memory
allocation failures?

If devm_kcalloc() fails inside asus_ec_hwmon_add_chan_info(), it returns
-ENOMEM and leaves asus_ec_hwmon_chan->config as NULL.

Since the return value is ignored here, the uninitialized struct is passed
to devm_hwmon_device_register_with_info(). The hwmon core unconditionally
dereferences the config pointer in hwmon_num_channel_attrs(), which could
cause a kernel oops on probe during memory pressure.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260712110650.1240071-2-eugene.shalygin@gmail.com?part=1