[PATCH 0/3] hwmon: Fix issues in pt5161l, isl28022, and powerz

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@xxxxxxxxxxx>

Three fixes found during review of hwmon drivers on hwmon-next.

Patch 1 (pt5161l): The receive buffer passed to
i2c_smbus_read_block_data() is 24 bytes, which is less than the
I2C_SMBUS_BLOCK_MAX (32) bytes the helper may write.  Resize to
I2C_SMBUS_BLOCK_MAX.

Patch 2 (isl28022): The power reading computation can overflow a
32-bit 'long' with certain gain and shunt resistor configurations.
Widen the arithmetic to s64 using div_s64(), multiply before dividing
for better precision, and clamp the result to LONG_MAX before
returning through the hwmon callback.

Patch 3 (powerz): A window exists between URB teardown in
powerz_disconnect() and devm-managed hwmon device removal during
which sysfs reads may reference a freed URB.  Clear the interface
data and URB pointer so concurrent readers return an error instead.

Sanman Pradhan (3):
  hwmon: (pt5161l) Fix undersized buffer for i2c_smbus_read_block_data()
  hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit
  hwmon: (powerz) Fix potential use-after-free on USB disconnect

 drivers/hwmon/isl28022.c |  7 +++++--
 drivers/hwmon/powerz.c   | 11 +++++++++--
 drivers/hwmon/pt5161l.c  |  2 +-
 3 files changed, 15 insertions(+), 5 deletions(-)

-- 
2.34.1