[hwmon PATCH v2 0/8] hwmon: (adt7470): Multiple fixes

[hwmon PATCH v2 0/8] hwmon: (adt7470): Multiple fixes

[Luiz Angelo Daros de Luca]

This series fixes several issues in the adt7470 driver:

- Restore PWM configuration after I2C failures.
- Avoid cache corruption after failed writes.
- Prevent busy looping when auto_update_interval is zero.
- Fix incorrect temperature alarm reporting.
- Cache the PWM frequency and fix error propagation.
- Correct unused PWM auto-mode mask definitions.
- Fix TOCTOU issue when reading fan data.
- Fix PWM auto temp state array corruption and missing bounds check in
  sysfs read.

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
Changes in v2:
- Added new patch to fix TOCTOU divide-by-zero crash in fan speed read.
- "Fix temperature alarm logic...": Added TEMP_ALARM_BIT and
  FAN_ALARM_BIT macros for clarity.
- "Use cached PWM frequency value": Fixed incorrect array indexing by
  caching the closest frequency early.
- Added patch to fix PWM auto temp state array corruption and missing bounds check.
- Link to v1: https://patch.msgid.link/20260727-adt7470_thermalzone-v3-0-21424d550c3d@gmail.com

To: Guenter Roeck <linux@roeck-us.net>
To: Chris Packham <chris.packham@alliedtelesis.co.nz>
To: Andrew Morton <akpm@linux-foundation.org>
To: "Darrick J. Wong" <djwong@us.ibm.com>
To: "Mark M. Hoffman" <mhoffman@lightlink.com>
Cc: linux-hwmon@vger.kernel.org
Cc: linux-kernel@vger.kernel.org

---
Luiz Angelo Daros de Luca (8):
      hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
      hwmon: (adt7470) Fix cache updated before hardware write on I2C error
      hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
      hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
      hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
      hwmon: (adt7470) Use cached PWM frequency value
      hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
      hwmon: (adt7470) Fix PWM auto temp state array and bounds check

 drivers/hwmon/adt7470.c | 129 ++++++++++++++++++++++++++++++++++--------------
 1 file changed, 92 insertions(+), 37 deletions(-)
---
base-commit: 7e12ea5aae19ee07d466e9613ccba753349c9c1d
change-id: 20260716-adt7470_fixes-59a102278d72

Best regards,
--  
Luiz Angelo Daros de Luca <luizluca@gmail.com>

[hwmon PATCH v2 1/8] hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors

[Luiz Angelo Daros de Luca]

During adt7470_read_temperatures(), the driver temporarily switches
the PWM channels to manual mode, performs the temperature collection,
and then restores the original configuration registers.

However, if an I2C transaction fails at any point after entering manual
mode, the function aborts and returns immediately. This leaves the
configuration registers un-restored, permanently trapping the fans in
manual mode.

Introduce a recovery path to ensure that the original PWM configuration
registers are always restored, even when intermediate I2C operations
fail.

Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/r/20260716213252.EACA71F000E9@smtp.kernel.org
Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
 drivers/hwmon/adt7470.c | 40 +++++++++++++++++++++++++++++-----------
 1 file changed, 29 insertions(+), 11 deletions(-)

diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 664349756dc2..481d51617f4b 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -205,11 +205,12 @@ static inline int adt7470_write_word_data(struct adt7470_data *data, unsigned in
 /* Probe for temperature sensors.  Assumes lock is held */
 static int adt7470_read_temperatures(struct adt7470_data *data)
 {
-	unsigned long res;
+	struct device *dev = regmap_get_device(data->regmap);
+	u8 pwm[ADT7470_FAN_COUNT];
 	unsigned int pwm_cfg[2];
-	int err;
+	unsigned long res;
+	int err, err2;
 	int i;
-	u8 pwm[ADT7470_FAN_COUNT];
 
 	/* save pwm[1-4] config register */
 	err = regmap_read(data->regmap, ADT7470_REG_PWM_CFG(0), &pwm_cfg[0]);
@@ -233,19 +234,19 @@ static int adt7470_read_temperatures(struct adt7470_data *data)
 	err = regmap_update_bits(data->regmap, ADT7470_REG_PWM_CFG(2),
 				 ADT7470_PWM_AUTO_MASK, 0);
 	if (err < 0)
-		return err;
+		goto out_restore;
 
 	/* write pwm control to whatever it was */
 	err = regmap_bulk_write(data->regmap, ADT7470_REG_PWM(0), &pwm[0],
 				ADT7470_PWM_COUNT);
 	if (err < 0)
-		return err;
+		goto out_restore;
 
 	/* start reading temperature sensors */
 	err = regmap_update_bits(data->regmap, ADT7470_REG_CFG,
 				 ADT7470_T05_STB_MASK, ADT7470_T05_STB_MASK);
 	if (err < 0)
-		return err;
+		goto out_restore;
 
 	/* Delay is 200ms * number of temp sensors. */
 	res = msleep_interruptible((data->num_temp_sensors >= 0 ?
@@ -256,13 +257,30 @@ static int adt7470_read_temperatures(struct adt7470_data *data)
 	err = regmap_update_bits(data->regmap, ADT7470_REG_CFG,
 				 ADT7470_T05_STB_MASK, 0);
 	if (err < 0)
-		return err;
+		goto out_restore;
 
+out_restore:
 	/* restore pwm[1-4] config registers */
-	err = regmap_write(data->regmap, ADT7470_REG_PWM_CFG(0), pwm_cfg[0]);
-	if (err < 0)
-		return err;
-	err = regmap_write(data->regmap, ADT7470_REG_PWM_CFG(2), pwm_cfg[1]);
+	err2 = regmap_write(data->regmap, ADT7470_REG_PWM_CFG(0), pwm_cfg[0]);
+	if (err2 < 0) {
+		dev_warn_ratelimited(dev,
+				     "failed to restore PWM{1,2} config (%d)\n",
+				     err2);
+
+		if (!err)
+			err = err2;
+	}
+
+	err2 = regmap_write(data->regmap, ADT7470_REG_PWM_CFG(2), pwm_cfg[1]);
+	if (err2 < 0) {
+		dev_warn_ratelimited(dev,
+				     "failed to restore PWM{3,4} config (%d)\n",
+				     err2);
+
+		if (!err)
+			err = err2;
+	}
+
 	if (err < 0)
 		return err;
 

-- 
2.55.0

Re: [hwmon PATCH v2 1/8] hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors

[sashiko-bot]

> During adt7470_read_temperatures(), the driver temporarily switches
> the PWM channels to manual mode, performs the temperature collection,
> and then restores the original configuration registers.
> 
> However, if an I2C transaction fails at any point after entering manual
> mode, the function aborts and returns immediately. This leaves the
> configuration registers un-restored, permanently trapping the fans in
> manual mode.
> 
> Introduce a recovery path to ensure that the original PWM configuration
> registers are always restored, even when intermediate I2C operations
> fail.
> 
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/r/20260716213252.EACA71F000E9@smtp.kernel.org
> Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727-adt7470_fixes-v2-0-598e38a46ba6@gmail.com?part=1

Re: [hwmon PATCH v2 1/8] hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors

[Guenter Roeck]

On Mon, Jul 27, 2026 at 09:22:17PM -0300, Luiz Angelo Daros de Luca wrote:
> During adt7470_read_temperatures(), the driver temporarily switches
> the PWM channels to manual mode, performs the temperature collection,
> and then restores the original configuration registers.
> 
> However, if an I2C transaction fails at any point after entering manual
> mode, the function aborts and returns immediately. This leaves the
> configuration registers un-restored, permanently trapping the fans in
> manual mode.
> 
> Introduce a recovery path to ensure that the original PWM configuration
> registers are always restored, even when intermediate I2C operations
> fail.
> 
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/r/20260716213252.EACA71F000E9@smtp.kernel.org
> Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Applied.

Thanks,
Guenter

[hwmon PATCH v2 2/8] hwmon: (adt7470) Fix cache updated before hardware write on I2C error

[Luiz Angelo Daros de Luca]

adt7470_temp_write() and adt7470_pwm_write() update the driver's
cached values (temp_min, temp_max, pwm_input, pwm_enable) before issuing
the corresponding regmap_write(), and never check whether the write
succeeded before committing that update. If the I2C transaction fails,
the function correctly propagates the error to the caller, but the cache
silently keeps the new value, which was never actually applied to the
hardware. Subsequent reads then report a value that does not match the
device state.

Reorder both write paths to update the cache only after a successful
regmap_write(), so the cache always reflects what was actually
written to the hardware.

Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
 drivers/hwmon/adt7470.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 481d51617f4b..62ec68ea0a40 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -589,14 +589,16 @@ static int adt7470_temp_write(struct device *dev, u32 attr, int channel, long va
 	switch (attr) {
 	case hwmon_temp_min:
 		mutex_lock(&data->lock);
-		data->temp_min[channel] = val;
 		err = regmap_write(data->regmap, ADT7470_TEMP_MIN_REG(channel), val);
+		if (!err)
+			data->temp_min[channel] = val;
 		mutex_unlock(&data->lock);
 		break;
 	case hwmon_temp_max:
 		mutex_lock(&data->lock);
-		data->temp_max[channel] = val;
 		err = regmap_write(data->regmap, ADT7470_TEMP_MAX_REG(channel), val);
+		if (!err)
+			data->temp_max[channel] = val;
 		mutex_unlock(&data->lock);
 		break;
 	default:
@@ -831,9 +833,10 @@ static int adt7470_pwm_write(struct device *dev, u32 attr, int channel, long val
 	case hwmon_pwm_input:
 		val = clamp_val(val, 0, 255);
 		mutex_lock(&data->lock);
-		data->pwm[channel] = val;
 		err = regmap_write(data->regmap, ADT7470_REG_PWM(channel),
-				   data->pwm[channel]);
+				   val);
+		if (!err)
+			data->pwm[channel] = val;
 		mutex_unlock(&data->lock);
 		break;
 	case hwmon_pwm_enable:
@@ -847,10 +850,11 @@ static int adt7470_pwm_write(struct device *dev, u32 attr, int channel, long val
 		val--;
 
 		mutex_lock(&data->lock);
-		data->pwm_automatic[channel] = val;
 		err = regmap_update_bits(data->regmap, ADT7470_REG_PWM_CFG(channel),
 					 pwm_auto_reg_mask,
 					 val ? pwm_auto_reg_mask : 0);
+		if (!err)
+			data->pwm_automatic[channel] = val;
 		mutex_unlock(&data->lock);
 		break;
 	case hwmon_pwm_freq:

-- 
2.55.0

Re: [hwmon PATCH v2 2/8] hwmon: (adt7470) Fix cache updated before hardware write on I2C error

[sashiko-bot]

> adt7470_temp_write() and adt7470_pwm_write() update the driver's
> cached values (temp_min, temp_max, pwm_input, pwm_enable) before issuing
> the corresponding regmap_write(), and never check whether the write
> succeeded before committing that update. If the I2C transaction fails,
> the function correctly propagates the error to the caller, but the cache
> silently keeps the new value, which was never actually applied to the
> hardware. Subsequent reads then report a value that does not match the
> device state.
> 
> Reorder both write paths to update the cache only after a successful
> regmap_write(), so the cache always reflects what was actually
> written to the hardware.
> 
> Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727-adt7470_fixes-v2-0-598e38a46ba6@gmail.com?part=2

Re: [hwmon PATCH v2 2/8] hwmon: (adt7470) Fix cache updated before hardware write on I2C error

[Guenter Roeck]

On Mon, Jul 27, 2026 at 09:22:18PM -0300, Luiz Angelo Daros de Luca wrote:
> adt7470_temp_write() and adt7470_pwm_write() update the driver's
> cached values (temp_min, temp_max, pwm_input, pwm_enable) before issuing
> the corresponding regmap_write(), and never check whether the write
> succeeded before committing that update. If the I2C transaction fails,
> the function correctly propagates the error to the caller, but the cache
> silently keeps the new value, which was never actually applied to the
> hardware. Subsequent reads then report a value that does not match the
> device state.
> 
> Reorder both write paths to update the cache only after a successful
> regmap_write(), so the cache always reflects what was actually
> written to the hardware.
> 
> Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Applied.

Thanks,
Guenter

[hwmon PATCH v2 3/8] hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

[Luiz Angelo Daros de Luca]

When userspace configures 'auto_update_interval' to 0 via sysfs, the
background kthread executes schedule_timeout_interruptible(0), which
returns immediately.

If 'num_temp_sensors' is concurrently or previously set to 0, the
msleep_interruptible() delay inside adt7470_read_temperatures() also
becomes 0. This combination forces the background thread into a tight,
unbounded busy-loop, hogging the CPU and flooding the I2C bus with a
continuous stream of transactions.

Fix this vulnerability by raising the lower limit of the clamp_val in
auto_update_interval_store() from 0 to 500 milliseconds. This guarantees
a reasonable minimum sleep window between sensor updates, protecting the
system from intentional or accidental I2C bus denial of service.

Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/r/20260716213252.EACA71F000E9@smtp.kernel.org
Fixes: 89fac11cb3e7 ("adt7470: make automatic fan control really work")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
 drivers/hwmon/adt7470.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 62ec68ea0a40..0b19b0925d1c 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -509,7 +509,7 @@ static ssize_t auto_update_interval_store(struct device *dev,
 	if (kstrtol(buf, 10, &temp))
 		return -EINVAL;
 
-	temp = clamp_val(temp, 0, 60000);
+	temp = clamp_val(temp, 500, 60000);
 
 	mutex_lock(&data->lock);
 	data->auto_update_interval = temp;

-- 
2.55.0

Re: [hwmon PATCH v2 3/8] hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Setting `num_temp_sensors` to a non-negative value before temperatures have been probed permanently breaks temperature reporting and stalls sysfs reads.
--

--- Patch [3]: [hwmon PATCH v2 3/8] hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread ---
commit 34430e742760a7d00b9b258ac39d10dadd63f0d0
Author: Luiz Angelo Daros de Luca <luizluca@gmail.com>

hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

This commit fixes a busy-loop vulnerability in the background thread.
It clamps the minimum auto_update_interval to 500ms to guarantee a
reasonable minimum sleep window between sensor updates.

Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/r/20260716213252.EACA71F000E9@smtp.kernel.org
Fixes: 89fac11cb3e7 ("adt7470: make automatic fan control really work")

> diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
> index 62ec68ea0a406..0b19b0925d1c7 100644
> --- a/drivers/hwmon/adt7470.c
> +++ b/drivers/hwmon/adt7470.c
> @@ -509,7 +509,7 @@ static ssize_t auto_update_interval_store(struct device *dev,
>  	if (kstrtol(buf, 10, &temp))
>  		return -EINVAL;
>  
> -	temp = clamp_val(temp, 0, 60000);
> +	temp = clamp_val(temp, 500, 60000);
>  
>  	mutex_lock(&data->lock);
>  	data->auto_update_interval = temp;

[Severity: High]
This is a pre-existing issue, but does setting num_temp_sensors before
temperatures are probed prevent temperature reporting and stall sysfs reads?

If userspace writes a non-negative value to the num_temp_sensors sysfs node
before data->temperatures_probed is set to 1, data->temperatures_probed
remains 0:

drivers/hwmon/adt7470.c:num_temp_sensors_store() {
	...
	data->num_temp_sensors = temp;
	if (temp < 0)
		data->temperatures_probed = 0;
	...
}

Because temperatures_probed is 0, adt7470_update_sensors() will always call
adt7470_read_temperatures() rather than a bulk read. Inside
adt7470_read_temperatures(), it checks the sensor count:

drivers/hwmon/adt7470.c:adt7470_read_temperatures() {
	...
	/* Only count fans if we have to */
	if (data->num_temp_sensors >= 0)
		return 0;

	err = regmap_bulk_read(data->regmap, ADT7470_TEMP_REG(0),
			       &data->temp[0], ADT7470_TEMP_COUNT);
	...
	data->temperatures_probed = 1;
	return 0;
}

Since num_temp_sensors >= 0, it returns early and never actually reads the
temperature registers or sets data->temperatures_probed = 1. This appears to
cause every subsequent sensor update to stall the driver with the probe sleep
time while never actually updating data->temp.

Could num_temp_sensors_store() also set data->temperatures_probed = 1 when
temp >= 0, or should adt7470_read_temperatures() read the registers
regardless of the num_temp_sensors value?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727-adt7470_fixes-v2-0-598e38a46ba6@gmail.com?part=3

Re: [hwmon PATCH v2 3/8] hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

[Guenter Roeck]

On Mon, Jul 27, 2026 at 09:22:19PM -0300, Luiz Angelo Daros de Luca wrote:
> When userspace configures 'auto_update_interval' to 0 via sysfs, the
> background kthread executes schedule_timeout_interruptible(0), which
> returns immediately.
> 
> If 'num_temp_sensors' is concurrently or previously set to 0, the
> msleep_interruptible() delay inside adt7470_read_temperatures() also
> becomes 0. This combination forces the background thread into a tight,
> unbounded busy-loop, hogging the CPU and flooding the I2C bus with a
> continuous stream of transactions.
> 
> Fix this vulnerability by raising the lower limit of the clamp_val in
> auto_update_interval_store() from 0 to 500 milliseconds. This guarantees
> a reasonable minimum sleep window between sensor updates, protecting the
> system from intentional or accidental I2C bus denial of service.
> 
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/r/20260716213252.EACA71F000E9@smtp.kernel.org
> Fixes: 89fac11cb3e7 ("adt7470: make automatic fan control really work")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Applied.

Thanks,
Guenter

[hwmon PATCH v2 4/8] hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks

[Luiz Angelo Daros de Luca]

The ADT7470_PWM3_AUTO_MASK and ADT7470_PWM4_AUTO_MASK macros are
currently defined with swapped bit values.

According to Table 22 of the ADT7470 datasheet, the Fan Control Mode
Configuration for register 0x69 follows the exact same bit position
layout as register 0x68:
- 0x68 Bit[7] corresponds to BHVR1 (PWM1) -> 0x80
- 0x68 Bit[6] corresponds to BHVR2 (PWM2) -> 0x40
- 0x69 Bit[7] corresponds to BHVR3 (PWM3) -> 0x80
- 0x69 Bit[6] corresponds to BHVR4 (PWM4) -> 0x40

Consequently, PWM3 should use mask 0x80 and PWM4 should use 0x40.

This typo did not cause any functional bugs because these specific
macros are never referenced in the driver code. Instead, the driver
correctly applies the configuration by relying on the modulo parity of
the channel index (e.g., `channel % 2`) to selectively apply either
ADT7470_PWM1_AUTO_MASK (0x80) or ADT7470_PWM2_AUTO_MASK (0x40).
Since the bit layout is identical between the two configuration
registers, the hardware is currently configured correctly.

Fix the macro definitions to reflect the datasheet accurately and
prevent future bugs or confusion during code review and refactoring.
As this is a purely cosmetic fix with no functional impact, a backport
to stable kernels is not necessary.

Fixes: 6f9703d0be16 ("hwmon: add support for adt7470")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
 drivers/hwmon/adt7470.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 0b19b0925d1c..a34635526aaa 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -70,8 +70,8 @@ static const unsigned short normal_i2c[] = { 0x2C, 0x2E, 0x2F, I2C_CLIENT_END };
 #define		ADT7470_PWM1_AUTO_MASK		0x80
 #define		ADT7470_PWM_AUTO_MASK		0xC0
 #define ADT7470_REG_PWM34_CFG			0x69
-#define		ADT7470_PWM3_AUTO_MASK		0x40
-#define		ADT7470_PWM4_AUTO_MASK		0x80
+#define		ADT7470_PWM4_AUTO_MASK		0x40
+#define		ADT7470_PWM3_AUTO_MASK		0x80
 #define	ADT7470_REG_PWM_MIN_BASE_ADDR		0x6A
 #define ADT7470_REG_PWM_MIN_MAX_ADDR		0x6D
 #define ADT7470_REG_PWM_TEMP_MIN_BASE_ADDR	0x6E

-- 
2.55.0

Re: [hwmon PATCH v2 4/8] hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but there is an invalid bitwise index check in `hwmon_temp_alarm` leading to incorrect or missing temperature alarms.
- [High] This problem wasn't introduced by this patch, but a typo in `pwm_auto_temp_store` mistakenly assigns to `data->pwm_automatic` instead of `data->pwm_auto_temp`, corrupting driver cache state.
--

--- Patch [4]: [hwmon PATCH v2 4/8] hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks ---
commit 5ed1ddc6459d007f79bfd20aad146b331e6158a6
Author: Luiz Angelo Daros de Luca <luizluca@gmail.com>

hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks

This commit swaps the values for ADT7470_PWM3_AUTO_MASK and
ADT7470_PWM4_AUTO_MASK to correctly match the datasheet. The driver
relies on the modulo parity of the channel index to configure the hardware,
so this fix does not alter driver behavior.

> diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
> index 0b19b0925d1c7..a34635526aaa2 100644
> --- a/drivers/hwmon/adt7470.c
> +++ b/drivers/hwmon/adt7470.c

[ ... ]

[Severity: High]
This problem wasn't introduced by this patch, but there is an invalid bitwise
index check in adt7470_temp_read() leading to incorrect or missing temperature
alarms:

adt7470_temp_read() {
    ...
	case hwmon_temp_alarm:
		*val = !!(data->alarm & channel);
		break;
    ...
}

Does this code use the integer channel index directly as a bitmask against
the data->alarm state? If so, sensor 0 would never report an alarm, and
other sensors would report false alarms based on incorrect bitmask evaluation
rather than a bit shift like (1 << channel).

[Severity: High]
This is a pre-existing issue, but a typo in pwm_auto_temp_store() mistakenly
assigns to data->pwm_automatic instead of data->pwm_auto_temp:

pwm_auto_temp_store() {
    ...
	mutex_lock(&data->lock);
	data->pwm_automatic[attr->index] = temp;
    ...
}

Is this assignment intended? It appears to write the parsed temperature
channel mapping value to the PWM enable state array (pwm_automatic) instead
of pwm_auto_temp. Writing to pwmN_auto_channels_temp would silently corrupt
the cached pwm_automatic state, which tracks whether the PWM is in manual
or auto mode, potentially causing subsequent reads of pwmN_enable to return
out-of-spec values to userspace.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727-adt7470_fixes-v2-0-598e38a46ba6@gmail.com?part=4

Re: [hwmon PATCH v2 4/8] hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks

[Guenter Roeck]

On Mon, Jul 27, 2026 at 09:22:20PM -0300, Luiz Angelo Daros de Luca wrote:
> The ADT7470_PWM3_AUTO_MASK and ADT7470_PWM4_AUTO_MASK macros are
> currently defined with swapped bit values.
> 
> According to Table 22 of the ADT7470 datasheet, the Fan Control Mode
> Configuration for register 0x69 follows the exact same bit position
> layout as register 0x68:
> - 0x68 Bit[7] corresponds to BHVR1 (PWM1) -> 0x80
> - 0x68 Bit[6] corresponds to BHVR2 (PWM2) -> 0x40
> - 0x69 Bit[7] corresponds to BHVR3 (PWM3) -> 0x80
> - 0x69 Bit[6] corresponds to BHVR4 (PWM4) -> 0x40
> 
> Consequently, PWM3 should use mask 0x80 and PWM4 should use 0x40.
> 
> This typo did not cause any functional bugs because these specific
> macros are never referenced in the driver code. Instead, the driver
> correctly applies the configuration by relying on the modulo parity of
> the channel index (e.g., `channel % 2`) to selectively apply either
> ADT7470_PWM1_AUTO_MASK (0x80) or ADT7470_PWM2_AUTO_MASK (0x40).
> Since the bit layout is identical between the two configuration
> registers, the hardware is currently configured correctly.
> 
> Fix the macro definitions to reflect the datasheet accurately and
> prevent future bugs or confusion during code review and refactoring.
> As this is a purely cosmetic fix with no functional impact, a backport
> to stable kernels is not necessary.
> 
> Fixes: 6f9703d0be16 ("hwmon: add support for adt7470")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Applied.

Thanks,
Guenter

[hwmon PATCH v2 5/8] hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()

[Luiz Angelo Daros de Luca]

During the conversion the alarm callback started interpreting the
channel index as an alarm bitmask, resulting in incorrect alarm
reporting. Compute the proper alarm bit instead.

Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/r/20260717211224.B9E291F000E9@smtp.kernel.org
Fixes: fc958a61ff6d ("hwmon: (adt7470) Convert to devm_hwmon_device_register_with_info API")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
 drivers/hwmon/adt7470.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index a34635526aaa..c6fc7d38d698 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -110,6 +110,21 @@ static const unsigned short normal_i2c[] = { 0x2C, 0x2E, 0x2F, I2C_CLIENT_END };
 
 #define ALARM2(x)		((x) << 8)
 
+/* TEMP1..TEMP7 (ch 0..6) are, respectively BIT(0)..BIT(6) of reg 0x41 and
+ * 0x72, or BIT(0)..BIT(6) of data->alarm.
+ * TEMP8..TEMP9 (ch 7..9) are, respectively BIT(0)..BIT(2) of reg 0x42 and
+ * 0x73, or BIT(8)..BIT(10) of data->alarm.
+ */
+#define TEMP_ALARM_BIT(ch)	({		\
+	typeof(ch) _ch = (ch);			\
+	(1 << (_ch < 7 ? _ch : _ch + 1));	\
+})
+
+/* FAN1..FAN4 (ch 0..3) are respectively BIT(4)..BIT(7) in
+ * reg 0x42 and 0x73 or BIT(12)..BIT(15) in data->alarm.
+ */
+#define FAN_ALARM_BIT(ch)	(1 << (12 + (ch)))
+
 #define ADT7470_VENDOR		0x41
 #define ADT7470_DEVICE		0x70
 /* datasheet only mentions a revision 2 */
@@ -569,7 +584,7 @@ static int adt7470_temp_read(struct device *dev, u32 attr, int channel, long *va
 		*val = 1000 * data->temp_max[channel];
 		break;
 	case hwmon_temp_alarm:
-		*val = !!(data->alarm & channel);
+		*val = !!(data->alarm & TEMP_ALARM_BIT(channel));
 		break;
 	default:
 		return -EOPNOTSUPP;
@@ -668,7 +683,7 @@ static int adt7470_fan_read(struct device *dev, u32 attr, int channel, long *val
 			*val = 0;
 		break;
 	case hwmon_fan_alarm:
-		*val = !!(data->alarm & (1 << (12 + channel)));
+		*val = !!(data->alarm & FAN_ALARM_BIT(channel));
 		break;
 	default:
 		return -EOPNOTSUPP;

-- 
2.55.0

Re: [hwmon PATCH v2 5/8] hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()

[sashiko-bot]

> During the conversion the alarm callback started interpreting the
> channel index as an alarm bitmask, resulting in incorrect alarm
> reporting. Compute the proper alarm bit instead.
> 
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/r/20260717211224.B9E291F000E9@smtp.kernel.org
> Fixes: fc958a61ff6d ("hwmon: (adt7470) Convert to devm_hwmon_device_register_with_info API")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727-adt7470_fixes-v2-0-598e38a46ba6@gmail.com?part=5

Re: [hwmon PATCH v2 5/8] hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()

[Guenter Roeck]

On Mon, Jul 27, 2026 at 09:22:21PM -0300, Luiz Angelo Daros de Luca wrote:
> During the conversion the alarm callback started interpreting the
> channel index as an alarm bitmask, resulting in incorrect alarm
> reporting. Compute the proper alarm bit instead.
> 
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/r/20260717211224.B9E291F000E9@smtp.kernel.org
> Fixes: fc958a61ff6d ("hwmon: (adt7470) Convert to devm_hwmon_device_register_with_info API")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Applied.

Thanks,
Guenter

[hwmon PATCH v2 6/8] hwmon: (adt7470) Use cached PWM frequency value

[Luiz Angelo Daros de Luca]

adt7470_pwm_read() currently ignores failures returned by
pwm1_freq_get(). If the register read fails, the negative error code is
returned through *val while the function itself reports success,
potentially exposing a negative PWM frequency through sysfs.

Fix this by using the cached PWM frequency maintained by the driver,
eliminating the register access from the read path.

Apart from the corrected error propagation and using the cached value,
no functional change is intended.

Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
 drivers/hwmon/adt7470.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index c6fc7d38d698..1fbca4869b7b 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -182,6 +182,7 @@ struct adt7470_data {
 	u8			pwm_min[ADT7470_PWM_COUNT];
 	s8			pwm_tmin[ADT7470_PWM_COUNT];
 	u8			pwm_auto_temp[ADT7470_PWM_COUNT];
+	u32			pwm_freq;
 
 	struct task_struct	*auto_update;
 	unsigned int		auto_update_interval;
@@ -756,7 +757,7 @@ static ssize_t force_pwm_max_store(struct device *dev,
 }
 
 /* These are the valid PWM frequencies to the nearest Hz */
-static const int adt7470_freq_map[] = {
+static const u32 adt7470_freq_map[] = {
 	11, 15, 22, 29, 35, 44, 59, 88, 1400, 22500
 };
 
@@ -796,7 +797,7 @@ static int adt7470_pwm_read(struct device *dev, u32 attr, int channel, long *val
 		*val = 1 + data->pwm_automatic[channel];
 		break;
 	case hwmon_pwm_freq:
-		*val = pwm1_freq_get(dev);
+		*val = data->pwm_freq;
 		break;
 	default:
 		return -EOPNOTSUPP;
@@ -809,12 +810,14 @@ static int pwm1_freq_set(struct device *dev, long freq)
 {
 	struct adt7470_data *data = dev_get_drvdata(dev);
 	unsigned int low_freq = ADT7470_CFG_LF;
+	u32 closest_freq;
 	int index;
 	int err;
 
 	/* Round the user value given to the closest available frequency */
 	index = find_closest(freq, adt7470_freq_map,
 			     ARRAY_SIZE(adt7470_freq_map));
+	closest_freq = adt7470_freq_map[index];
 
 	if (index >= 8) {
 		index -= 8;
@@ -832,6 +835,10 @@ static int pwm1_freq_set(struct device *dev, long freq)
 	err = regmap_update_bits(data->regmap, ADT7470_REG_CFG_2,
 				 ADT7470_FREQ_MASK,
 				 index << ADT7470_FREQ_SHIFT);
+	if (err < 0)
+		goto out;
+
+	data->pwm_freq = closest_freq;
 out:
 	mutex_unlock(&data->lock);
 
@@ -1285,6 +1292,7 @@ static int adt7470_probe(struct i2c_client *client)
 	struct device *dev = &client->dev;
 	struct adt7470_data *data;
 	struct device *hwmon_dev;
+	int freq_val;
 	int err;
 
 	data = devm_kzalloc(dev, sizeof(struct adt7470_data), GFP_KERNEL);
@@ -1309,6 +1317,14 @@ static int adt7470_probe(struct i2c_client *client)
 	if (err < 0)
 		return err;
 
+	freq_val = pwm1_freq_get(dev);
+	if (freq_val <= 0) {
+		err = freq_val < 0 ? freq_val : -EINVAL;
+		return err;
+	}
+
+	data->pwm_freq = (u32)freq_val;
+
 	/* Register sysfs hooks */
 	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
 							 &adt7470_chip_info,

-- 
2.55.0

Re: [hwmon PATCH v2 6/8] hwmon: (adt7470) Use cached PWM frequency value

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] A partial register write failure in pwm1_freq_set leaves the cached pwm_freq permanently out of sync with the actual hardware state.
--

--- Patch [6]: [hwmon PATCH v2 6/8] hwmon: (adt7470) Use cached PWM frequency value ---
commit 3b9b6b91fb202f2983f66278540c1017bb53f4e6
Author: Luiz Angelo Daros de Luca <luizluca@gmail.com>

hwmon: (adt7470) Use cached PWM frequency value

This commit updates the ADT7470 driver to use a cached PWM frequency
value instead of querying the hardware on each read. The cache is 
initialized during probe and updated after a successful write operation 
to prevent exposing negative error codes through sysfs if a read fails.

> diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
> index c6fc7d38d698c..1fbca4869b7b6 100644
> --- a/drivers/hwmon/adt7470.c
> +++ b/drivers/hwmon/adt7470.c

[ ... ]

> @@ -832,6 +835,10 @@ static int pwm1_freq_set(struct device *dev, long freq)
>  	err = regmap_update_bits(data->regmap, ADT7470_REG_CFG_2,
>  				 ADT7470_FREQ_MASK,
>  				 index << ADT7470_FREQ_SHIFT);
> +	if (err < 0)
> +		goto out;
> +
> +	data->pwm_freq = closest_freq;
>  out:
>  	mutex_unlock(&data->lock);

[Severity: Medium]
Does this leave the cached pwm_freq out of sync with the hardware if the
second register write fails?

If regmap_update_bits() fails for ADT7470_REG_CFG_2, the function aborts
and jumps to out without updating data->pwm_freq. However, the first
register (ADT7470_REG_CFG) may have already been updated successfully right
above this snippet.

Because adt7470_pwm_read() now relies solely on this cache instead of
reading the hardware, sysfs reads will permanently return the old frequency
value even though the hardware might be operating in a mixed frequency
state.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727-adt7470_fixes-v2-0-598e38a46ba6@gmail.com?part=6

Re: [hwmon PATCH v2 6/8] hwmon: (adt7470) Use cached PWM frequency value

[Guenter Roeck]

On 7/27/26 17:36, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] A partial register write failure in pwm1_freq_set leaves the cached pwm_freq permanently out of sync with the actual hardware state.
> --
> 

I don't know a good way of fixing this. If this error condition really
happens, the chip is in bad shape either case. Trying to write the old
value into the first register might fail as well, and then what ?

Ok to leave it alone.

Guenter

> --- Patch [6]: [hwmon PATCH v2 6/8] hwmon: (adt7470) Use cached PWM frequency value ---
> commit 3b9b6b91fb202f2983f66278540c1017bb53f4e6
> Author: Luiz Angelo Daros de Luca <luizluca@gmail.com>
> 
> hwmon: (adt7470) Use cached PWM frequency value
> 
> This commit updates the ADT7470 driver to use a cached PWM frequency
> value instead of querying the hardware on each read. The cache is
> initialized during probe and updated after a successful write operation
> to prevent exposing negative error codes through sysfs if a read fails.
> 
>> diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
>> index c6fc7d38d698c..1fbca4869b7b6 100644
>> --- a/drivers/hwmon/adt7470.c
>> +++ b/drivers/hwmon/adt7470.c
> 
> [ ... ]
> 
>> @@ -832,6 +835,10 @@ static int pwm1_freq_set(struct device *dev, long freq)
>>   	err = regmap_update_bits(data->regmap, ADT7470_REG_CFG_2,
>>   				 ADT7470_FREQ_MASK,
>>   				 index << ADT7470_FREQ_SHIFT);
>> +	if (err < 0)
>> +		goto out;
>> +
>> +	data->pwm_freq = closest_freq;
>>   out:
>>   	mutex_unlock(&data->lock);
> 
> [Severity: Medium]
> Does this leave the cached pwm_freq out of sync with the hardware if the
> second register write fails?
> 
> If regmap_update_bits() fails for ADT7470_REG_CFG_2, the function aborts
> and jumps to out without updating data->pwm_freq. However, the first
> register (ADT7470_REG_CFG) may have already been updated successfully right
> above this snippet.
> 
> Because adt7470_pwm_read() now relies solely on this cache instead of
> reading the hardware, sysfs reads will permanently return the old frequency
> value even though the hardware might be operating in a mixed frequency
> state.
> 

Re: [hwmon PATCH v2 6/8] hwmon: (adt7470) Use cached PWM frequency value

[Guenter Roeck]

On Mon, Jul 27, 2026 at 09:22:22PM -0300, Luiz Angelo Daros de Luca wrote:
> adt7470_pwm_read() currently ignores failures returned by
> pwm1_freq_get(). If the register read fails, the negative error code is
> returned through *val while the function itself reports success,
> potentially exposing a negative PWM frequency through sysfs.
> 
> Fix this by using the cached PWM frequency maintained by the driver,
> eliminating the register access from the read path.
> 
> Apart from the corrected error propagation and using the cached value,
> no functional change is intended.
> 
> Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Applied.

Thanks,
Guenter

[hwmon PATCH v2 7/8] hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read

[Luiz Angelo Daros de Luca]

If the fan data becomes 0 between the FAN_DATA_VALID() check and the
FAN_PERIOD_TO_RPM() conversion, it will result in a divide-by-zero crash
due to a race with a concurrent update of the cached fan value.

Fix a TOCTOU issue by reading fan data once.

Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/r/20260727034929.E29B71F000E9@smtp.kernel.org/
Fixes: fc958a61ff6d ("hwmon: (adt7470) Convert to devm_hwmon_device_register_with_info API")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
 drivers/hwmon/adt7470.c | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 1fbca4869b7b..772d2a409bb5 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -660,36 +660,33 @@ static ssize_t alarm_mask_store(struct device *dev,
 static int adt7470_fan_read(struct device *dev, u32 attr, int channel, long *val)
 {
 	struct adt7470_data *data = adt7470_update_device(dev);
+	u16 fan_data;
 
 	if (IS_ERR(data))
 		return PTR_ERR(data);
 
 	switch (attr) {
 	case hwmon_fan_input:
-		if (FAN_DATA_VALID(data->fan[channel]))
-			*val = FAN_PERIOD_TO_RPM(data->fan[channel]);
-		else
-			*val = 0;
+		fan_data = READ_ONCE(data->fan[channel]);
 		break;
 	case hwmon_fan_min:
-		if (FAN_DATA_VALID(data->fan_min[channel]))
-			*val = FAN_PERIOD_TO_RPM(data->fan_min[channel]);
-		else
-			*val = 0;
+		fan_data = READ_ONCE(data->fan_min[channel]);
 		break;
 	case hwmon_fan_max:
-		if (FAN_DATA_VALID(data->fan_max[channel]))
-			*val = FAN_PERIOD_TO_RPM(data->fan_max[channel]);
-		else
-			*val = 0;
+		fan_data = READ_ONCE(data->fan_max[channel]);
 		break;
 	case hwmon_fan_alarm:
 		*val = !!(data->alarm & FAN_ALARM_BIT(channel));
-		break;
+		return 0;
 	default:
 		return -EOPNOTSUPP;
 	}
 
+	if (FAN_DATA_VALID(fan_data))
+		*val = FAN_PERIOD_TO_RPM(fan_data);
+	else
+		*val = 0;
+
 	return 0;
 }
 

-- 
2.55.0

Re: [hwmon PATCH v2 7/8] hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing TOCTOU vulnerabilities in multiple hwmon drivers due to unsafe macro evaluation of unlocked array values, leading to divide-by-zero crashes.
- [High] The driver violates hwmon subsystem guidelines by failing to use hwmon_lock() for extra sysfs attributes and the background kthread, leaving lockless accesses exposed to data races.
- [High] Transient zeroing of `data->alarm` state causes missing alarms due to lockless sysfs reads.
--

--- Patch [7]: [hwmon PATCH v2 7/8] hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read ---
commit c42c0e5abb409dc36e59b29c77b757552ecfb7d9
Author: Luiz Angelo Daros de Luca <luizluca@gmail.com>

hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
    
This commit fixes a time-of-check to time-of-use (TOCTOU) bug in the adt7470
driver by reading the fan data only once. Previously, a concurrent update
could zero out the fan data between the validation check and the RPM
conversion, causing a divide-by-zero.

Link: https://lore.kernel.org/r/20260727034929.E29B71F000E9@smtp.kernel.org/

> diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
> index 1fbca4869b7b6..772d2a409bb5c 100644
> --- a/drivers/hwmon/adt7470.c
> +++ b/drivers/hwmon/adt7470.c
> @@ -660,36 +660,33 @@ static ssize_t alarm_mask_store(struct device *dev,
>  static int adt7470_fan_read(struct device *dev, u32 attr, int channel, long *val)
>  {
>  	struct adt7470_data *data = adt7470_update_device(dev);

[Severity: High]
This is a pre-existing issue, but does this driver fail to serialize sysfs
attributes and the background kthread properly?

The hwmon subsystem guidelines mandate that drivers use hwmon_lock() and
hwmon_unlock() to serialize attributes registered by any other means than
the core info template.

This driver registers several extra attributes, such as alarm_mask_show(),
via the extra_groups parameter in adt7470_probe() and runs a background
auto_update kthread. None of these paths acquire hwmon_lock(), and instead
invoke adt7470_update_device(), which uses a private internal data->lock.

Meanwhile, standard hwmon core operations read from the cache arrays
locklessly, assuming the core holds hwmon_lock(). Can this architectural
locking mismatch create unprotected data races against concurrent updates?

> +	u16 fan_data;
>  
>  	if (IS_ERR(data))
>  		return PTR_ERR(data);
>  
>  	switch (attr) {

[ ... ]

>  	case hwmon_fan_alarm:
>  		*val = !!(data->alarm & FAN_ALARM_BIT(channel));

[Severity: High]
This isn't a bug introduced by this patch, but could this lockless read of
data->alarm evaluate to 0 incorrectly and miss an active alarm?

In adt7470_update_sensors(), data->alarm is first assigned the low byte:

	err = regmap_read(data->regmap, ADT7470_REG_ALARM1, &val);
	...
	data->alarm = val;
	if (data->alarm & ADT7470_OOL_ALARM) {
		...
		data->alarm |= ALARM2(val);
	}

This temporarily zeroes out the upper 8 bits. Because adt7470_fan_read()
accesses data->alarm locklessly after adt7470_update_device() releases
data->lock, could a concurrent sysfs read happen exactly during this transient
state and completely miss an active fan or high-channel temperature alarm?

> -		break;
> +		return 0;
>  	default:
>  		return -EOPNOTSUPP;
>  	}
>  
> +	if (FAN_DATA_VALID(fan_data))
> +		*val = FAN_PERIOD_TO_RPM(fan_data);
> +	else
> +		*val = 0;
> +

[Severity: High]
This isn't a bug introduced by this patch, but do other hwmon drivers suffer
from the same TOCTOU bug that this patch fixes for adt7470?

In drivers/hwmon/adt7462.c:fan_show(), the shared array element is passed
directly to the FAN_PERIOD_TO_RPM macro without holding a lock:

	if (!fan_enabled(data, attr->index) ||
	    !FAN_DATA_VALID(data->fan[attr->index]))
		return sprintf(buf, "0\n");

	return sprintf(buf, "%d\n",
		       FAN_PERIOD_TO_RPM(data->fan[attr->index]));

Because the macro expands the argument multiple times, the shared state is read
once for the zero-check and again for the division. Could a concurrent update
modify the array element to zero immediately after the check, resulting in a
divide-by-zero?

>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727-adt7470_fixes-v2-0-598e38a46ba6@gmail.com?part=7

Re: [hwmon PATCH v2 7/8] hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read

[Guenter Roeck]

On Mon, Jul 27, 2026 at 09:22:23PM -0300, Luiz Angelo Daros de Luca wrote:
> If the fan data becomes 0 between the FAN_DATA_VALID() check and the
> FAN_PERIOD_TO_RPM() conversion, it will result in a divide-by-zero crash
> due to a race with a concurrent update of the cached fan value.
> 
> Fix a TOCTOU issue by reading fan data once.
> 
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/r/20260727034929.E29B71F000E9@smtp.kernel.org/
> Fixes: fc958a61ff6d ("hwmon: (adt7470) Convert to devm_hwmon_device_register_with_info API")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Applied.

Thanks,
Guenter

[hwmon PATCH v2 8/8] hwmon: (adt7470) Fix PWM auto temp state array and bounds check

[Luiz Angelo Daros de Luca]

In pwm_auto_temp_store(), the parsed user input was missing bounds
checks, allowing values > 0xF to overflow into the adjacent channel's
bits. Furthermore, the value was being incorrectly written to the
pwm_automatic state array instead of pwm_auto_temp.

Fix this by rejecting values > 0xF with -EINVAL, and assigning the
value to the correct array only after a successful I2C write.

Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260727034932.0B7C41F000E9@smtp.kernel.org/#t
Fixes: 6f9703d0be16 ("hwmon: add support for adt7470")
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
 drivers/hwmon/adt7470.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 772d2a409bb5..c45b984c02e6 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -1049,8 +1049,10 @@ static ssize_t pwm_auto_temp_store(struct device *dev,
 	if (temp < 0)
 		return temp;
 
+	if (temp > 0xF)
+		return -EINVAL;
+
 	mutex_lock(&data->lock);
-	data->pwm_automatic[attr->index] = temp;
 
 	if (!(attr->index % 2)) {
 		mask = 0xF0;
@@ -1061,6 +1063,9 @@ static ssize_t pwm_auto_temp_store(struct device *dev,
 	}
 
 	err = regmap_update_bits(data->regmap, pwm_auto_reg, mask, val);
+	if (!err)
+		data->pwm_auto_temp[attr->index] = temp;
+
 	mutex_unlock(&data->lock);
 
 	return err < 0 ? err : count;

-- 
2.55.0

Re: [hwmon PATCH v2 8/8] hwmon: (adt7470) Fix PWM auto temp state array and bounds check

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver violates HWMON subsystem guidelines by using a private mutex (`data->lock`) instead of the required `hwmon_lock()` API to serialize sysfs attributes registered outside the `info` structure.
--

--- Patch [8]: [hwmon PATCH v2 8/8] hwmon: (adt7470) Fix PWM auto temp state array and bounds check ---
commit 3702a967e9e4da59d546cf6a3b0fc208ec5ff2bf
Author: Luiz Angelo Daros de Luca <luizluca@gmail.com>

hwmon: (adt7470) Fix PWM auto temp state array and bounds check

This commit fixes a bounds checking issue in pwm_auto_temp_store() where
values > 0xF could overflow into adjacent channel bits. It also corrects
the array assignment so values are written to pwm_auto_temp instead of
pwm_automatic after a successful I2C write.

Closes: https://lore.kernel.org/all/20260727034932.0B7C41F000E9@smtp.kernel.org/#t

> diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
> index 772d2a409bb5c..c45b984c02e6b 100644
> --- a/drivers/hwmon/adt7470.c
> +++ b/drivers/hwmon/adt7470.c
> @@ -1049,8 +1049,10 @@ static ssize_t pwm_auto_temp_store(struct device *dev,
>  	if (temp < 0)
>  		return temp;
>  
> +	if (temp > 0xF)
> +		return -EINVAL;
> +
>  	mutex_lock(&data->lock);

[Severity: High]
This is a pre-existing issue, but does this driver violate the hwmon
subsystem locking guidelines by using a private mutex here?

According to the hardware monitoring API documentation, drivers must
implement locking required for interrupt handling and for attributes
registered outside the standard info structure using hwmon_lock() and
hwmon_unlock(). The core relies on this to serialize thermal subsystem
and sysfs operations.

By using the private data->lock in pwm_auto_temp_store(), could this
bypass the central hwmon locking mechanism and cause concurrency issues
with the thermal subsystem?

Would it make sense to update this to use hwmon_lock(dev)?

> -	data->pwm_automatic[attr->index] = temp;
>  
>  	if (!(attr->index % 2)) {
>  		mask = 0xF0;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727-adt7470_fixes-v2-0-598e38a46ba6@gmail.com?part=8

Re: [hwmon PATCH v2 8/8] hwmon: (adt7470) Fix PWM auto temp state array and bounds check

[Guenter Roeck]

On Mon, Jul 27, 2026 at 09:22:24PM -0300, Luiz Angelo Daros de Luca wrote:
> In pwm_auto_temp_store(), the parsed user input was missing bounds
> checks, allowing values > 0xF to overflow into the adjacent channel's
> bits. Furthermore, the value was being incorrectly written to the
> pwm_automatic state array instead of pwm_auto_temp.
> 
> Fix this by rejecting values > 0xF with -EINVAL, and assigning the
> value to the correct array only after a successful I2C write.
> 
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/all/20260727034932.0B7C41F000E9@smtp.kernel.org/#t
> Fixes: 6f9703d0be16 ("hwmon: add support for adt7470")
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Applied.

Thanks,
Guenter

Re: [hwmon PATCH v2 0/8] hwmon: (adt7470): Multiple fixes

[Guenter Roeck]

On 7/27/26 17:22, Luiz Angelo Daros de Luca wrote:
> This series fixes several issues in the adt7470 driver:
> 
> - Restore PWM configuration after I2C failures.
> - Avoid cache corruption after failed writes.
> - Prevent busy looping when auto_update_interval is zero.
> - Fix incorrect temperature alarm reporting.
> - Cache the PWM frequency and fix error propagation.
> - Correct unused PWM auto-mode mask definitions.
> - Fix TOCTOU issue when reading fan data.
> - Fix PWM auto temp state array corruption and missing bounds check in
>    sysfs read.
> 
> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Thanks a lot for all the fixes. I applied the series.
Please feel free to fix more bugs in the driver if you feel like it ...

Note that Google decided (again) that my e-mails are spam, so you might not
receive this e-mail (and the others stating that I applied the patches) directly.

Guenter

Re: [hwmon PATCH v2 0/8] hwmon: (adt7470): Multiple fixes

[Luiz Angelo Daros de Luca]

> On 7/27/26 17:22, Luiz Angelo Daros de Luca wrote:
> > This series fixes several issues in the adt7470 driver:
> >
> > - Restore PWM configuration after I2C failures.
> > - Avoid cache corruption after failed writes.
> > - Prevent busy looping when auto_update_interval is zero.
> > - Fix incorrect temperature alarm reporting.
> > - Cache the PWM frequency and fix error propagation.
> > - Correct unused PWM auto-mode mask definitions.
> > - Fix TOCTOU issue when reading fan data.
> > - Fix PWM auto temp state array corruption and missing bounds check in
> >    sysfs read.
> >
> > Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
>
> Thanks a lot for all the fixes. I applied the series.
> Please feel free to fix more bugs in the driver if you feel like it ...

Thanks Guenter,

> Note that Google decided (again) that my e-mails are spam, so you might not
> receive this e-mail (and the others stating that I applied the patches) directly.

I'm safe. I created a filter to mark all messages to me that mention
@vger.kernel.org as non-spam.

> Guenter

Re: [hwmon PATCH v2 0/8] hwmon: (adt7470): Multiple fixes

[Guenter Roeck]

On 7/27/26 18:08, Luiz Angelo Daros de Luca wrote:
>> On 7/27/26 17:22, Luiz Angelo Daros de Luca wrote:
>>> This series fixes several issues in the adt7470 driver:
>>>
>>> - Restore PWM configuration after I2C failures.
>>> - Avoid cache corruption after failed writes.
>>> - Prevent busy looping when auto_update_interval is zero.
>>> - Fix incorrect temperature alarm reporting.
>>> - Cache the PWM frequency and fix error propagation.
>>> - Correct unused PWM auto-mode mask definitions.
>>> - Fix TOCTOU issue when reading fan data.
>>> - Fix PWM auto temp state array corruption and missing bounds check in
>>>     sysfs read.
>>>
>>> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
>>
>> Thanks a lot for all the fixes. I applied the series.
>> Please feel free to fix more bugs in the driver if you feel like it ...
> 
> Thanks Guenter,
> 
>> Note that Google decided (again) that my e-mails are spam, so you might not
>> receive this e-mail (and the others stating that I applied the patches) directly.
> 
> I'm safe. I created a filter to mark all messages to me that mention
> @vger.kernel.org as non-spam.
> 


That doesn't help. My e-mails are not just marked as spam. Gmail often
refuses to send them out, claiming that they are spam.

Guenter