linux-kernel - [PATCH 1/3] hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241216173648.526-2-m.masimov@maxima.ru>
Date: Mon, 16 Dec 2024 20:36:46 +0300
From: Murad Masimov <m.masimov@...ima.ru>
To: Eric Tremblay <etremblay@...tech-controls.com>
CC: Jean Delvare <jdelvare@...e.com>, Guenter Roeck <linux@...ck-us.net>,
	<linux-hwmon@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<lvc-project@...uxtesting.org>, Murad Masimov <m.masimov@...ima.ru>
Subject: [PATCH 1/3] hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers

The values returned by the driver after processing the contents of the
Shunt Voltage Register and the Shunt Limit Registers do not correspond to the
TMP512/TMP513 specifications. A raw register value is converted to a signed
integer value by a sign extension in accordance with the algorithm provided in
the specification, but due to the off-by-one error in the sign bit index, the
result is incorrect. Moreover, the PGA shift calculated with the
tmp51x_get_pga_shift function is relevant only to the Shunt Voltage Register,
but is also applied to the Shunt Limit Registers.

According to the TMP512 and TMP513 datasheets, the Shunt Voltage Register (04h)
is 13 to 16 bit two's complement integer value, depending on the PGA setting.
The Shunt Positive (0Ch) and Negative (0Dh) Limit Registers are 16-bit two's
complement integer values. Below are some examples:

* Shunt Voltage Register
If PGA = 8, and regval = 1000 0011 0000 0000, then the decimal value must
be -32000, but the value calculated by the driver will be 33536.

* Shunt Limit Register
If regval = 1000 0011 0000 0000, then the decimal value must be -32000, but
the value calculated by the driver will be 768, if PGA = 1.

Fix sign bit index, and also correct misleading comment describing the
tmp51x_get_pga_shift function.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
Signed-off-by: Murad Masimov <m.masimov@...ima.ru>
---
 drivers/hwmon/tmp513.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
index 926d28cd3fab..d401cb55de14 100644
--- a/drivers/hwmon/tmp513.c
+++ b/drivers/hwmon/tmp513.c
@@ -182,7 +182,7 @@ struct tmp51x_data {
 	struct regmap *regmap;
 };

-// Set the shift based on the gain 8=4, 4=3, 2=2, 1=1
+// Set the shift based on the gain: 8 -> 1, 4 -> 2, 2 -> 3, 1 -> 4
 static inline u8 tmp51x_get_pga_shift(struct tmp51x_data *data)
 {
 	return 5 - ffs(data->pga_gain);
@@ -204,7 +204,9 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
 		 * 2's complement number shifted by one to four depending
 		 * on the pga gain setting. 1lsb = 10uV
 		 */
-		*val = sign_extend32(regval, 17 - tmp51x_get_pga_shift(data));
+		*val = sign_extend32(regval,
+			reg == TMP51X_SHUNT_CURRENT_RESULT ?
+			16 - tmp51x_get_pga_shift(data) : 15);
 		*val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms);
 		break;
 	case TMP51X_BUS_VOLTAGE_RESULT:
--
2.39.2