Re: [PATCH v5 3/3] hwmon: pmbus: add MPQ8646 driver

On 7/23/26 17:06, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Stack variables passed to i2c_transfer() can cause memory corruption or panics with CONFIG_VMAP_STACK.
> --
> 
> --- Patch [3]: [PATCH v5 3/3] hwmon: pmbus: add MPQ8646 driver ---
> commit 1098fecfca1c29b33a174b200465134bc5be4be8
> Author: Vincent Jardin <[email protected]>
> 
> hwmon: pmbus: add MPQ8646 driver
> 
> Add a new single-chip driver for the MPS MPQ8646 that is a PMBus device.
> The driver adds extended bits decode, alarm acknowledge, gate-close retry,
> and an in-driver alarm-poll fallback.
> 
>> diff --git a/drivers/hwmon/pmbus/mpq8646.c b/drivers/hwmon/pmbus/mpq8646.c
>> index 0000000000000..f8dfabef09df3 100644
>> --- /dev/null
>> +++ b/drivers/hwmon/pmbus/mpq8646.c
> [ ... ]
>> @@ -187,24 +187,24 @@ static inline struct mpq8646_priv *mpq8646_priv_from_client(struct i2c_client *c
>>   static int mpq8646_raw_xfer_rword(struct i2c_client *client, u8 reg)
>>   {
>>   	u8 cmd = reg;
>>   	__le16 data = 0;
>>   	struct i2c_msg msg[] = {
>>   		{
>>   			.addr = client->addr,
>>   			.flags = 0,
>>   			.len = sizeof(cmd),
>>   			.buf = &cmd,
>>   		},
>>   		{
>>   			.addr = client->addr,
>>   			.flags = I2C_M_RD,
>>   			.len = sizeof(data),
>>   			.buf = (u8 *)&data,
>>   		},
>>   	};
>>   	int rc;
>>   
>>   	rc = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
> 
> [Severity: High]
> Can this cause memory corruption or a kernel panic?
> 
> I2C adapter drivers often use DMA for transfers. When CONFIG_VMAP_STACK is
> enabled, the kernel stack is not guaranteed to be physically contiguous.
> Passing stack-allocated buffers like cmd and data to DMA-capable APIs
> like i2c_transfer() will cause dma_map_single() to map incorrect physical
> memory.
> 
> Although this is triggered via debugfs, executing it on a DMA-capable I2C bus
> could reliably crash or corrupt the system. Should these buffers be dynamically
> allocated instead?
> 

Do not address. This is a false positive. Sashiko's I2C subsystem prompts
need to be updated.

Guenter