linux-kernel - [PATCH 3/3] hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241216173648.526-4-m.masimov@maxima.ru>
Date: Mon, 16 Dec 2024 20:36:48 +0300
From: Murad Masimov <m.masimov@...ima.ru>
To: Eric Tremblay <etremblay@...tech-controls.com>
CC: Jean Delvare <jdelvare@...e.com>, Guenter Roeck <linux@...ck-us.net>,
	<linux-hwmon@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<lvc-project@...uxtesting.org>, Murad Masimov <m.masimov@...ima.ru>
Subject: [PATCH 3/3] hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers

The values returned by the driver after processing the contents of the
Temperature Result and the Temperature Limit Registers do not correspond to the
TMP512/TMP513 specifications. A raw register value is converted to a signed
integer value by a sign extension in accordance with the algorithm provided
in the specification, but due to the off-by-one error in the sign bit index,
the result is incorrect.

According to the TMP512 and TMP513 datasheets, the Temperature Result (08h to 0Bh)
and Limit (11h to 14h) Registers are 13-bit two's complement integer values,
shifted left by 3 bits. The value is scaled by 0.0625 degrees Celsius per bit.
E.g., if regval = 1 1110 0111 0000 000, the output should be -25 degrees,
but the driver will return +487 degrees.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
Signed-off-by: Murad Masimov <m.masimov@...ima.ru>
---
 drivers/hwmon/tmp513.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
index dacce7417bfd..be63a049923a 100644
--- a/drivers/hwmon/tmp513.c
+++ b/drivers/hwmon/tmp513.c
@@ -234,7 +234,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
 	case TMP51X_REMOTE_TEMP_LIMIT_2:
 	case TMP513_REMOTE_TEMP_LIMIT_3:
 		// 1lsb = 0.0625 degrees centigrade
-		*val = sign_extend32(regval, 16) >> TMP51X_TEMP_SHIFT;
+		*val = sign_extend32(regval, 15) >> TMP51X_TEMP_SHIFT;
 		*val = DIV_ROUND_CLOSEST(*val * 625, 10);
 		break;
 	case TMP51X_N_FACTOR_AND_HYST_1:
--
2.39.2