kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/hwmon/pmbus
History
Sanman Pradhan 73a7a34581 hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read 
commit 25dd70a03b upstream.

The q54sj108a2_debugfs_read function suffers from a stack buffer overflow
due to incorrect arguments passed to bin2hex(). The function currently
passes 'data' as the destination and 'data_char' as the source.

Because bin2hex() converts each input byte into two hex characters, a
32-byte block read results in 64 bytes of output. Since 'data' is only
34 bytes (I2C_SMBUS_BLOCK_MAX + 2), this writes 30 bytes past the end
of the buffer onto the stack.

Additionally, the arguments were swapped: it was reading from the
zero-initialized 'data_char' and writing to 'data', resulting in
all-zero output regardless of the actual I2C read.

Fix this by:
1. Expanding 'data_char' to 66 bytes to safely hold the hex output.
2. Correcting the bin2hex() argument order and using the actual read count.
3. Using a pointer to select the correct output buffer for the final
   simple_read_from_buffer call.

Fixes: d014538aa3 ("hwmon: (pmbus) Driver for Delta power supplies Q54SJ108A2")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260304235116.1045-1-sanman.p211993@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-03-19 16:08:37 +01:00
..
acbel-fsg032.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
adm1266.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
adm1275.c hwmon: (pmbus/adm1275) add sq24905c support 2025-09-07 16:33:47 -07:00
adp1050.c hwmon: (pmbus/adp1050) Add regulator support for ltp8800 2025-07-20 16:38:34 -07:00
bel-pfe.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
bpa-rs600.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
crps.c hwmon: (pmbus/crps) Add Intel CRPS185 power supply 2024-12-18 07:14:58 -08:00
delta-ahe50dc-fan.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
dps920ab.c hwmon: pmbus: dps920ab: Add ability to instantiate through i2c 2025-01-13 08:57:06 -08:00
fsp-3y.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
ibm-cffps.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
ina233.c hwmon: Add driver for TI INA233 Current and Power Monitor 2025-03-18 08:03:37 -07:00
inspur-ipsps.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
ir35221.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
ir36021.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
ir38064.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
irps5401.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
isl68137.c hwmon: (pmbus/isl68137) Fix child node reference leak on early return 2025-10-19 18:56:14 -07:00
Kconfig hwmon: add MP29502 driver 2025-09-08 06:13:16 -07:00
lm25066.c hwmon: (pmbus) Do not set regulators_node for single-channel chips 2025-04-23 07:18:27 -07:00
lt3074.c hwmon: (pmbus/lt3074) add support for lt3074 2025-04-23 07:18:27 -07:00
lt7182s.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
ltc2978.c hwmon: (pmbus/ltc2978) add support for lt717x 2025-03-17 08:05:08 -07:00
ltc3815.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
ltc4286.c hwmon: (pmbus/ltc4286) Drop unused i2c device ids 2024-07-10 07:11:34 -07:00
Makefile hwmon: add MP29502 driver 2025-09-08 06:13:16 -07:00
max8688.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
max15301.c hwmon: (pmbus/max15301) Add support for MAX15303 2025-01-08 09:17:49 -08:00
max16064.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
max16601.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
max20730.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
max20751.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
max31785.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
max34440.c hwmon: (pmbus/max34440) Update adpm12160 coeff due to latest FW 2025-10-19 18:56:14 -07:00
mp2856.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mp2869.c hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver 2025-09-07 16:35:18 -07:00
mp2888.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mp2891.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mp2975.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mp2993.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mp5023.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mp5920.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mp5990.c hwmon: (pmbus/mp5990) add support for MP5998 2025-09-24 07:38:07 -07:00
mp9941.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mp29502.c hwmon: add MP29502 driver 2025-09-08 06:13:16 -07:00
mpq7932.c hwmon: (pmbus) Do not set regulators_node for single-channel chips 2025-04-23 07:18:27 -07:00
mpq8785.c hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification 2026-02-26 14:59:15 -08:00
pim4328.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
pli1209bc.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
pm6764tr.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
pmbus.c hwmon: (pmbus) Initialise page count in pmbus_identify() 2025-03-02 08:27:22 -08:00
pmbus.h hwmon: (pmbus) Do not set regulators_node for single-channel chips 2025-04-23 07:18:27 -07:00
pmbus_core.c hwmon: (pmbus) Introduce page_change_delay 2025-04-23 07:18:27 -07:00
pxe1610.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
q54sj108a2.c hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read 2026-03-19 16:08:37 +01:00
stpddc60.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
tda38640.c hwmon: (pmbus) Do not set regulators_node for single-channel chips 2025-04-23 07:18:27 -07:00
tps546d24.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
tps25990.c hwmon: (pmbus) Do not set regulators_node for single-channel chips 2025-04-23 07:18:27 -07:00
tps40422.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
tps53679.c hwmon: (pmbus/tps53679) Add support for TPS53685 2025-07-20 16:38:34 -07:00
ucd9000.c treewide: rename GPIO set callbacks back to their original names 2025-08-07 10:07:06 +02:00
ucd9200.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
xdp710.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
xdpe152c4.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
xdpe12284.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
zl6100.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00