Re: [PATCH v9 2/2] iio: adc: add MAX40080 current-sense amplifier driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] Missing return length check for i2c_smbus_read_i2c_block_data() allows short reads to be silently treated as valid 32-bit IV data.
- [Medium] The commit message claims to expose a 'hardware-gain' attribute, but the code does not implement it.
--

commit 87fd945caf9aab4104e807fcc33f50c06d67bb4c
Author: Stefan Popa <stefan.popa@analog.com>

    iio: adc: add MAX40080 current-sense amplifier driver
    
    The MAX40080 is a bidirectional current-sense amplifier with an
    integrated 12-bit ADC and an I2C/SMBus interface. It measures the
    voltage across an external shunt resistor and the input bus voltage,
    storing the results in an internal FIFO.

>     Add a direct-mode IIO driver exposing the current and voltage channels
>     with raw, scale and hardware-gain attributes, a configurable

[Severity: Medium]
The commit message claims to expose a hardware-gain attribute, but is this
actually implemented in the code?

Looking at max40080_channels, the promised hardware-gain attribute appears to
be structurally omitted in favor of standard scale representations:

> diff --git a/drivers/iio/adc/max40080.c b/drivers/iio/adc/max40080.c
> new file mode 100644
> index 0000000000000..6864ce1cb0633
> --- /dev/null
> +++ b/drivers/iio/adc/max40080.c
[ ... ]
> +static const struct iio_chan_spec max40080_channels[] = {
> +	{
> +		.type = IIO_CURRENT,
> +		.indexed = 1,
> +		.channel = 0,
> +		.info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
> +				      BIT(IIO_CHAN_INFO_SCALE),

[ ... ]

> +static int max40080_read_iv_once(struct max40080_state *st, u32 *iv)
> +{
> +	__le32 buf = 0;
> +	int ret;
> +
> +	ret = i2c_smbus_read_i2c_block_data(st->client, MAX40080_REG_IV,
> +					    sizeof(buf), (u8 *)&buf);
> +	if (ret < 0)
> +		return ret;

[Severity: Medium]
Does this code silently treat short I2C block reads as valid data?

Since i2c_smbus_read_i2c_block_data() returns the number of bytes read
on success, checking only if ret < 0 ignores the returned length. If the
transfer returns fewer bytes than requested, the unpopulated MSB retains
its initialized zero value, which could cause a persistent validation failure
and timeout loop in the caller.

> +
> +	*iv = le32_to_cpu(buf);
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831134334.196359-1-stefan.popa@analog.com?part=2