Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Stack variables passed to i2c_transfer() can cause memory corruption or panics with CONFIG_VMAP_STACK.
--
--- Patch [3]: [PATCH v5 3/3] hwmon: pmbus: add MPQ8646 driver ---
commit 1098fecfca1c29b33a174b200465134bc5be4be8
Author: Vincent Jardin <[email protected]>
hwmon: pmbus: add MPQ8646 driver
Add a new single-chip driver for the MPS MPQ8646 that is a PMBus device.
The driver adds extended bits decode, alarm acknowledge, gate-close retry,
and an in-driver alarm-poll fallback.
> diff --git a/drivers/hwmon/pmbus/mpq8646.c b/drivers/hwmon/pmbus/mpq8646.c
> index 0000000000000..f8dfabef09df3 100644
> --- /dev/null
> +++ b/drivers/hwmon/pmbus/mpq8646.c
[ ... ]
> @@ -187,24 +187,24 @@ static inline struct mpq8646_priv *mpq8646_priv_from_client(struct i2c_client *c
> static int mpq8646_raw_xfer_rword(struct i2c_client *client, u8 reg)
> {
> u8 cmd = reg;
> __le16 data = 0;
> struct i2c_msg msg[] = {
> {
> .addr = client->addr,
> .flags = 0,
> .len = sizeof(cmd),
> .buf = &cmd,
> },
> {
> .addr = client->addr,
> .flags = I2C_M_RD,
> .len = sizeof(data),
> .buf = (u8 *)&data,
> },
> };
> int rc;
>
> rc = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
[Severity: High]
Can this cause memory corruption or a kernel panic?
I2C adapter drivers often use DMA for transfers. When CONFIG_VMAP_STACK is
enabled, the kernel stack is not guaranteed to be physically contiguous.
Passing stack-allocated buffers like cmd and data to DMA-capable APIs
like i2c_transfer() will cause dma_map_single() to map incorrect physical
memory.
Although this is triggered via debugfs, executing it on a DMA-capable I2C bus
could reliably crash or corrupt the system. Should these buffers be dynamically
allocated instead?
--
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.