Re: [PATCH v2 7/8] iio: adc: ti-ads112c14: implement gain on internal short SYS_MON channel

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Unlocked concurrent accesses to `gain_val` variables can result in data races and potentially corrupted scale values being returned to userspace.
--

commit d2600e3b47039aca86a7fafcbbec65c4180a38f5
Author: David Lechner (TI) <dlechner@baylibre.com>

iio: adc: ti-ads112c14: implement gain on internal short SYS_MON channel

Implement support for the programmable gain amplifier on the internal short
SYS_MON channel. This channel is used for calibration, so it is useful to be
able to set the PGA to the same gain as the external channels.

> diff --git a/drivers/iio/adc/ti-ads112c14.c b/drivers/iio/adc/ti-ads112c14.c
> index c61d472447325..0e775dbc8d50b 100644
> --- a/drivers/iio/adc/ti-ads112c14.c
> +++ b/drivers/iio/adc/ti-ads112c14.c
[ ... ]
> @@ -371,6 +401,17 @@ static int ads112c14_read_raw(struct iio_dev *indio_dev,
>  			return IIO_VAL_FRACTIONAL_LOG2;
>  		}
>  
> +		if (chan->channel == ADS112C14_SYS_MON_CHANNEL_SHORT) {
> +			u8 idx = data->sys_mon_chan_short_gain_val;
> +
> +			scale_avail = data->sys_mon_chan_short_scale_available[idx];
> +
> +			*val = scale_avail[0];
> +			*val2 = scale_avail[1];
> +
> +			return IIO_VAL_INT_PLUS_NANO;
> +		}
> +

[Severity: Medium]
Is it possible for a concurrent write from ads112c14_write_raw() to cause a
data race here?

Since this read side in ads112c14_read_raw() does not acquire the IIO direct
mode lock or use READ_ONCE(), the compiler could reload 
data->sys_mon_chan_short_gain_val.

If the value gets reloaded between the assignments of *val and *val2, the
function might fetch the integer and fractional parts from different gain
configurations, returning a corrupted scale to userspace.

[ ... ]
> +static int ads112c14_write_raw(struct iio_dev *indio_dev,
> +			       struct iio_chan_spec const *chan, int val,
> +			       int val2, long mask)
> +{
[ ... ]
> +		IIO_DEV_ACQUIRE_DIRECT_MODE(indio_dev, claim);
> +		if (IIO_DEV_ACQUIRE_FAILED(claim))
> +			return -EBUSY;
> +
> +		for (u32 i = 0; i < ARRAY_SIZE(ads112c14_pga_gains_x10); i++) {
> +			if (val == scale_avail[i][0] && val2 == scale_avail[i][1]) {
> +				*gain_val = i;
> +				return 0;
> +			}
> +		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625-iio-adc-ti-ads122c14-v2-0-ceb9b0b561cb@baylibre.com?part=7