Re: [RFT PATCH] hwmon: (pmbus) Fix type confusion in notification logic

On 8/2/26 07:18, Vincent Jardin wrote:
> Hi Guenter,
> 
>> However, data->group.attrs can contain other types like struct
>> pmbus_samples_reg or struct pmbus_sensor, which only embed a base
>> struct device_attribute.
>>
>> If da is a struct pmbus_samples_reg, dev_attr is the last member. Casting
>> it to struct sensor_device_attribute and reading the index field appears
>> to access memory past the end of the allocation, which might trigger a
>> slab-out-of-bounds read.
>>
>> Additionally, if da is a struct pmbus_sensor, casting it causes the index
>> field to overlap with the page, phase, and reg fields. Could this produce
>> a garbage mask on little-endian systems that spuriously matches the target
>> reg, page, and flags during an alert?
>>
>> Fix the problem by using struct sensor_device_attr in struct pmbus_sensor
>> and struct pmbus_label. Since those attributes never trigger a
>> notification, set the value of attr->index to -1 for them. Use this value
>> to distinguish from boolean attributes which _can_ trigger a notification
>> and use the index field to encode mask, page, and register values.
>>
>> Fixes: f469bde9afd1 ("hwmon: (pmbus/core) Notify hwmon events")
>> Cc: Vincent Jardin <[email protected]>
>> Signed-off-by: Guenter Roeck <[email protected]>
>> ---
>> RFT: Build-tested only
> 
> I tested on my board today but I did cherry pick the the 5 commits from:
>    https://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git/log/?h=hwmon-next
> 	hwmon: (pmbus) Fix type confusion in notification logic <-- this RFT
> 	hwmon: (pmbus/mpq8646) Gate the writes
> 	hwmon: (pmbus) Add MPQ8646 driver
> 	dt-bindings: hwmon: pmbus: add MPS MPQ8646
> 	hwmon: (pmbus/core) export pmbus_check_and_notify_faults()
> 
> Beside testing it with the attributes and boolean alarms of the MPQ8646, I did
> test it with the board's PSU that is another PMBUus device and exposes some attributes
> and boolean alarms too.
> 
> Both were OK.
> 
> Tested-by: Vincent Jardin <[email protected]>
> 
Thanks a lot!

Guenter