Re: [PATCH 3/7] ASoC: codecs: wsa883x: Accept temperatures across the full trim range

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] ASoC: wsa883x: unsigned cache in wsa883x_get_temp() corrupts negative temps
--

commit 48fab137fbfecfa73800bb6d589df9724b78ae8e
Author: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>

ASoC: codecs: wsa883x: Accept temperatures across the full trim range

This commit expands the valid temperature threshold range in
wsa883x_get_temp() from 5..45 degC to the full -10..150 degC two-point
trim range using inclusive comparisons.

> diff --git a/sound/soc/codecs/wsa883x.c b/sound/soc/codecs/wsa883x.c
> index 442cf9f3eaac7..ccd4404c1644e 100644
> --- a/sound/soc/codecs/wsa883x.c
> +++ b/sound/soc/codecs/wsa883x.c
> @@ -456,10 +456,11 @@
>  
>  /*
>   * Device will report senseless data in many cases, so discard any measurements
> - * outside of valid range.
> + * outside of the two-point trim range. Do not narrow this to ambient: a
> + * speaker that has been playing easily runs well above 45 degC.
>   */
> -#define WSA883X_LOW_TEMP_THRESHOLD	5
> -#define WSA883X_HIGH_TEMP_THRESHOLD	45
> +#define WSA883X_LOW_TEMP_THRESHOLD	WSA883X_T1_TEMP
> +#define WSA883X_HIGH_TEMP_THRESHOLD	WSA883X_T2_TEMP
>  
>  struct wsa883x_priv {
>  	struct regmap *regmap;
> @@ -1430,7 +1431,7 @@ static int wsa883x_get_temp(struct wsa883x_priv *wsa883x, long *temp)
>  	unsigned int dmeas_msb = 0, dmeas_lsb = 0;
>  	int d1, d2, dmeas;
>  	unsigned int mask;
> -	int ret, range;
> +	int ret;
>  	long val;
>  
>  	guard(mutex)(&wsa883x->sp_lock);
> @@ -1493,8 +1494,8 @@ static int wsa883x_get_temp(struct wsa883x_priv *wsa883x, long *temp)
>  	}
>  
>  	val = WSA883X_T1_TEMP + (((dmeas - d1) * (WSA883X_T2_TEMP - WSA883X_T1_TEMP)) / (d2 - d1));
> -	range = WSA883X_HIGH_TEMP_THRESHOLD - WSA883X_LOW_TEMP_THRESHOLD;
> -	if (in_range(val, WSA883X_LOW_TEMP_THRESHOLD, range)) {
> +	if (val >= WSA883X_LOW_TEMP_THRESHOLD &&
> +	    val <= WSA883X_HIGH_TEMP_THRESHOLD) {
>  		wsa883x->temperature = val;
>  		*temp = val * 1000;
>  		ret = 0;

[Severity: Medium]
With WSA883X_LOW_TEMP_THRESHOLD lowered to WSA883X_T1_TEMP (-10L), val in
wsa883x_get_temp() can now be negative (-10 to -1 degC). However,
wsa883x->temperature is declared as unsigned int in struct wsa883x_priv:

struct wsa883x_priv {
	...
	struct mutex sp_lock;
	unsigned int temperature;
	bool pa_on;
};

When wsa883x_get_temp() is called while wsa883x->pa_on is false and caches
a negative val into wsa883x->temperature, it wraps around as a 32-bit
unsigned value. If a subsequent call to wsa883x_get_temp() occurs while
wsa883x->pa_on is true:

	if (wsa883x->pa_on) {
		/*
		 * Reading temperature is possible only when Power Amplifier is
		 * off. Report last cached data.
		 */
		*temp = wsa883x->temperature * 1000;
		return 0;
	}

wsa883x->temperature * 1000 is evaluated in 32-bit unsigned arithmetic and
zero-extended into *temp (type long) on 64-bit architectures, reporting a
corrupted positive value around 4.29 billion millidegrees C instead of a
negative temperature.

Should temperature in struct wsa883x_priv be changed to a signed type such
as int or long?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023171316.819857-1-srinivas.kandagatla@oss.qualcomm.com?part=3