The values returned by the driver after processing the contents of the
Temperature Result and the Temperature Limit Registers do not correspond to the
TMP512/TMP513 specifications. A raw register value is converted to a signed
integer value by a sign extension in accordance with the algorithm provided
in the specification, but due to the off-by-one error in the sign bit index,
the result is incorrect.
According to the TMP512 and TMP513 datasheets, the Temperature Result (08h to 0Bh)
and Limit (11h to 14h) Registers are 13-bit two's complement integer values,
shifted left by 3 bits. The value is scaled by 0.0625 degrees Celsius per bit.
E.g., if regval = 1 1110 0111 0000 000, the output should be -25 degrees,
but the driver will return +487 degrees.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
Signed-off-by: Murad Masimov <m.masimov@xxxxxxxxx>
---
drivers/hwmon/tmp513.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
index dacce7417bfd..be63a049923a 100644
--- a/drivers/hwmon/tmp513.c
+++ b/drivers/hwmon/tmp513.c
@@ -234,7 +234,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
case TMP51X_REMOTE_TEMP_LIMIT_2:
case TMP513_REMOTE_TEMP_LIMIT_3:
// 1lsb = 0.0625 degrees centigrade
- *val = sign_extend32(regval, 16) >> TMP51X_TEMP_SHIFT;
+ *val = sign_extend32(regval, 15) >> TMP51X_TEMP_SHIFT;
*val = DIV_ROUND_CLOSEST(*val * 625, 10);
break;
case TMP51X_N_FACTOR_AND_HYST_1:
--
2.39.2
