2023-07-25 13:38:38

by Naresh Solanki

Subject: [PATCH v2 2/3] pmbus_core: Fix NULL pointer dereference

From: Patrick Rudolph <[email protected]>

Pass i2c_client to _pmbus_is_enabled to drop the assumption
that a regulator device is passed in.

This will fix the issue of a NULL pointer dereference when called from
_pmbus_get_flags.

Signed-off-by: Patrick Rudolph <[email protected]>
Signed-off-by: Naresh Solanki <[email protected]>
---
Changes in V2:
- Fix build error.
---
drivers/hwmon/pmbus/pmbus_core.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 42fb7286805b..30aeb59062a5 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -2745,9 +2745,8 @@ static const struct pmbus_status_category __maybe_unused pmbus_status_flag_map[]
},
};

-static int _pmbus_is_enabled(struct device *dev, u8 page)
+static int _pmbus_is_enabled(struct i2c_client *client, u8 page)
{
- struct i2c_client *client = to_i2c_client(dev->parent);
int ret;

ret = _pmbus_read_byte_data(client, page, PMBUS_OPERATION);
@@ -2758,14 +2757,13 @@ static int _pmbus_is_enabled(struct device *dev, u8 page)
return !!(ret & PB_OPERATION_CONTROL_ON);
}

-static int __maybe_unused pmbus_is_enabled(struct device *dev, u8 page)
+static int __maybe_unused pmbus_is_enabled(struct i2c_client *client, u8 page)
{
- struct i2c_client *client = to_i2c_client(dev->parent);
struct pmbus_data *data = i2c_get_clientdata(client);
int ret;

mutex_lock(&data->update_lock);
- ret = _pmbus_is_enabled(dev, page);
+ ret = _pmbus_is_enabled(client, page);
mutex_unlock(&data->update_lock);

return ret;
@@ -2844,7 +2842,7 @@ static int _pmbus_get_flags(struct pmbus_data *data, u8 page, unsigned int *flag
if (status < 0)
return status;

- if (_pmbus_is_enabled(dev, page)) {
+ if (_pmbus_is_enabled(client, page)) {
if (status & PB_STATUS_OFF) {
*flags |= REGULATOR_ERROR_FAIL;
*event |= REGULATOR_EVENT_FAIL;
@@ -2898,7 +2896,10 @@ static int __maybe_unused pmbus_get_flags(struct pmbus_data *data, u8 page, unsi
#if IS_ENABLED(CONFIG_REGULATOR)
static int pmbus_regulator_is_enabled(struct regulator_dev *rdev)
{
- return pmbus_is_enabled(rdev_get_dev(rdev), rdev_get_id(rdev));
+ struct device *dev = rdev_get_dev(rdev);
+ struct i2c_client *client = to_i2c_client(dev->parent);
+
+ return pmbus_is_enabled(client, rdev_get_id(rdev));
}

static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable)
--
2.41.0

2023-07-25 15:25:58

by Guenter Roeck

Subject: Re: [PATCH v2 2/3] pmbus_core: Fix NULL pointer dereference

On Tue, Jul 25, 2023 at 02:54:26PM +0200, Naresh Solanki wrote:
> From: Patrick Rudolph <[email protected]>
>
> Pass i2c_client to _pmbus_is_enabled to drop the assumption
> that a regulator device is passed in.
>
> This will fix the issue of a NULL pointer dereference when called from
> _pmbus_get_flags.
>
> Signed-off-by: Patrick Rudolph <[email protected]>
> Signed-off-by: Naresh Solanki <[email protected]>

Applied.

Thanks,
Guenter

> ---
> Changes in V2:
> - Fix build error.
> ---
> drivers/hwmon/pmbus/pmbus_core.c | 15 ++++++++-------
> 1 file changed, 8 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
> index 42fb7286805b..30aeb59062a5 100644
> --- a/drivers/hwmon/pmbus/pmbus_core.c
> +++ b/drivers/hwmon/pmbus/pmbus_core.c
> @@ -2745,9 +2745,8 @@ static const struct pmbus_status_category __maybe_unused pmbus_status_flag_map[]
> },
> };
>
> -static int _pmbus_is_enabled(struct device *dev, u8 page)
> +static int _pmbus_is_enabled(struct i2c_client *client, u8 page)
> {
> - struct i2c_client *client = to_i2c_client(dev->parent);
> int ret;
>
> ret = _pmbus_read_byte_data(client, page, PMBUS_OPERATION);
> @@ -2758,14 +2757,13 @@ static int _pmbus_is_enabled(struct device *dev, u8 page)
> return !!(ret & PB_OPERATION_CONTROL_ON);
> }
>
> -static int __maybe_unused pmbus_is_enabled(struct device *dev, u8 page)
> +static int __maybe_unused pmbus_is_enabled(struct i2c_client *client, u8 page)
> {
> - struct i2c_client *client = to_i2c_client(dev->parent);
> struct pmbus_data *data = i2c_get_clientdata(client);
> int ret;
>
> mutex_lock(&data->update_lock);
> - ret = _pmbus_is_enabled(dev, page);
> + ret = _pmbus_is_enabled(client, page);
> mutex_unlock(&data->update_lock);
>
> return ret;
> @@ -2844,7 +2842,7 @@ static int _pmbus_get_flags(struct pmbus_data *data, u8 page, unsigned int *flag
> if (status < 0)
> return status;
>
> - if (_pmbus_is_enabled(dev, page)) {
> + if (_pmbus_is_enabled(client, page)) {
> if (status & PB_STATUS_OFF) {
> *flags |= REGULATOR_ERROR_FAIL;
> *event |= REGULATOR_EVENT_FAIL;
> @@ -2898,7 +2896,10 @@ static int __maybe_unused pmbus_get_flags(struct pmbus_data *data, u8 page, unsi
> #if IS_ENABLED(CONFIG_REGULATOR)
> static int pmbus_regulator_is_enabled(struct regulator_dev *rdev)
> {
> - return pmbus_is_enabled(rdev_get_dev(rdev), rdev_get_id(rdev));
> + struct device *dev = rdev_get_dev(rdev);
> + struct i2c_client *client = to_i2c_client(dev->parent);
> +
> + return pmbus_is_enabled(client, rdev_get_id(rdev));
> }
>
> static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable)