Re: [PATCH v5 3/3] hwmon: pmbus: add MPQ8646 driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Stack variables passed to i2c_transfer() can cause memory corruption or panics with CONFIG_VMAP_STACK.
--

--- Patch [3]: [PATCH v5 3/3] hwmon: pmbus: add MPQ8646 driver ---
commit 1098fecfca1c29b33a174b200465134bc5be4be8
Author: Vincent Jardin <vjardin@free.fr>

hwmon: pmbus: add MPQ8646 driver

Add a new single-chip driver for the MPS MPQ8646 that is a PMBus device.
The driver adds extended bits decode, alarm acknowledge, gate-close retry,
and an in-driver alarm-poll fallback.

> diff --git a/drivers/hwmon/pmbus/mpq8646.c b/drivers/hwmon/pmbus/mpq8646.c
> index 0000000000000..f8dfabef09df3 100644
> --- /dev/null
> +++ b/drivers/hwmon/pmbus/mpq8646.c
[ ... ]
> @@ -187,24 +187,24 @@ static inline struct mpq8646_priv *mpq8646_priv_from_client(struct i2c_client *c
>  static int mpq8646_raw_xfer_rword(struct i2c_client *client, u8 reg)
>  {
>  	u8 cmd = reg;
>  	__le16 data = 0;
>  	struct i2c_msg msg[] = {
>  		{
>  			.addr = client->addr,
>  			.flags = 0,
>  			.len = sizeof(cmd),
>  			.buf = &cmd,
>  		},
>  		{
>  			.addr = client->addr,
>  			.flags = I2C_M_RD,
>  			.len = sizeof(data),
>  			.buf = (u8 *)&data,
>  		},
>  	};
>  	int rc;
>  
>  	rc = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));

[Severity: High]
Can this cause memory corruption or a kernel panic?

I2C adapter drivers often use DMA for transfers. When CONFIG_VMAP_STACK is
enabled, the kernel stack is not guaranteed to be physically contiguous.
Passing stack-allocated buffers like cmd and data to DMA-capable APIs
like i2c_transfer() will cause dma_map_single() to map incorrect physical
memory.

Although this is triggered via debugfs, executing it on a DMA-capable I2C bus
could reliably crash or corrupt the system. Should these buffers be dynamically
allocated instead?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724-mpq8646_v0-v5-0-5915b5ae9aa2@free.fr?part=3