Commit 6af713af authored by Abdurrahman Hussain's avatar Abdurrahman Hussain Committed by Guenter Roeck
Browse files

hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() 



adm1266_probe() calls adm1266_config_nvmem() -- which goes on to
devm_nvmem_register() and exposes adm1266_nvmem_read() to userspace --
before pmbus_do_probe() has initialised the per-client PMBus state.

Same latent hazard as the gpio_chip one fixed in the previous patch:
once the nvmem device is registered, gpiolib's nvmem char-dev / sysfs
interface is reachable, and any concurrent read triggers
adm1266_nvmem_read() -> adm1266_nvmem_read_blackbox(), which issues
PMBus traffic that races pmbus_do_probe()'s own device accesses with
no serialisation.

Move adm1266_config_nvmem() down past pmbus_do_probe() so the nvmem
device isn't reachable from userspace until the PMBus state the
nvmem accessors depend on is fully initialised.

Fixes: 15609d18 ("hwmon: (pmbus/adm1266) read blackbox")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarAbdurrahman Hussain <abdurrahman@nexthop.ai>
Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-5-e425e4f88139@nexthop.ai


Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
parent 491403b9

drivers/hwmon/pmbus/adm1266.c

+4 −4
Original line number Diff line number Diff line
@@ -477,14 +477,14 @@ static int adm1266_probe(struct i2c_client *client) 
	if (ret < 0)

		return ret;



	ret = adm1266_config_nvmem(data);

	if (ret < 0)

		return ret;



	ret = pmbus_do_probe(client, &data->info);

	if (ret)

		return ret;



	ret = adm1266_config_nvmem(data);

	if (ret < 0)

		return ret;



	ret = adm1266_config_gpio(data);

	if (ret < 0)

		return ret;