Re: [PATCH v1 2/4] ASoC: codecs: pm4125: Fix MBHC button threshold programming

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] pm4125: out-of-bounds register write in pm4125_mbhc_program_btn_thr()
--

commit 2cce30fa45a4f0c5ff81fb48ecba9f5d3b9f5681
Author: Mohammad Rafi Shaik <mohammad.rafi.shaik@oss.qualcomm.com>

ASoC: codecs: pm4125: Fix MBHC button threshold programming

This commit fixes MBHC button threshold programming by removing an
incorrect double shift of the threshold value before passing it to
snd_soc_component_write_field().

> diff --git a/sound/soc/codecs/pm4125.c b/sound/soc/codecs/pm4125.c
> index 674a2fbc4edae..923318c78d261 100644
> --- a/sound/soc/codecs/pm4125.c
> +++ b/sound/soc/codecs/pm4125.c
> @@ -981,7 +981,7 @@ static void pm4125_mbhc_program_btn_thr(struct snd_soc_component *component,
>  	for (i = 0; i < num_btn; i++) {
>  		vth = ((btn_high[i] * 2) / 25) & 0x3F;
>  		snd_soc_component_write_field(component, PM4125_ANA_MBHC_BTN0_ZDET_VREF1 + i,
> -					      PM4125_ANA_MBHC_BTN0_THRESHOLD_MASK, vth << 2);
> +					      PM4125_ANA_MBHC_BTN0_THRESHOLD_MASK, vth);

[Severity: High]
Does this code write past the end of the button threshold registers?

The pm4125_probe() function sets cfg->num_btn = PM4125_MBHC_MAX_BUTTONS
(which is defined as 8). However, the PM4125 codec only has 5 button
threshold registers:

sound/soc/codecs/pm4125.h:
#define PM4125_ANA_MBHC_BTN0_ZDET_VREF1         (PM4125_ANA_BASE_ADDR+0x060)
...
#define PM4125_ANA_MBHC_BTN4_ZDET_DBG_1400      (PM4125_ANA_BASE_ADDR+0x064)
#define PM4125_ANA_MBHC_MICB2_RAMP              (PM4125_ANA_BASE_ADDR+0x065)
#define PM4125_ANA_MBHC_CTL_1                   (PM4125_ANA_BASE_ADDR+0x066)

Because the loop iterates 8 times, it writes threshold voltages into offsets
0x065, 0x066, and 0x067. Can this silently corrupt the adjacent
PM4125_ANA_MBHC_MICB2_RAMP, PM4125_ANA_MBHC_CTL_1, and
PM4125_ANA_MBHC_CTL_2 registers?

>  	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015-pm4125_mbhc_support-v1-0-8bc1212db6f7@oss.qualcomm.com?part=2