From: Johannes Kirchmair Date: Wed, 29 Jan 2025 13:51:20 +0000 (+0100) Subject: Input: tsc2007 - prevent overflow in pressure calculation X-Git-Tag: v6.18-rc1~39^2^2~40 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9a12e2fb3f517d5bd72efa565a8e591e6fff311c;p=thirdparty%2Fkernel%2Flinux.git Input: tsc2007 - prevent overflow in pressure calculation The touch resistance calculation in the tsc2007 driver is prone to overflow if (z2 - z1) is large and also x is reasonably big. This overflow results in the driver emitting input events when very little touch pressure is applied. In these events the x and y coordinates can be substantially off. Avoid the overflow by using u64 when calculating resistance value. Signed-off-by: Johannes Kirchmair Link: https://lore.kernel.org/r/20250129-fix_tsc_calculation_overflow-v2-1-9e51333496ad@skidata.com Signed-off-by: Dmitry Torokhov --- diff --git a/drivers/input/touchscreen/tsc2007_core.c b/drivers/input/touchscreen/tsc2007_core.c index 05e00a084c88..948935de894b 100644 --- a/drivers/input/touchscreen/tsc2007_core.c +++ b/drivers/input/touchscreen/tsc2007_core.c @@ -23,6 +23,7 @@ #include #include #include +#include #include #include #include @@ -68,7 +69,7 @@ static void tsc2007_read_values(struct tsc2007 *tsc, struct ts_event *tc) u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc) { - u32 rt = 0; + u64 rt = 0; /* range filtering */ if (tc->x == MAX_12BIT) @@ -79,11 +80,13 @@ u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc) rt = tc->z2 - tc->z1; rt *= tc->x; rt *= tsc->x_plate_ohms; - rt /= tc->z1; + rt = div_u64(rt, tc->z1); rt = (rt + 2047) >> 12; } - return rt; + if (rt > U32_MAX) + return U32_MAX; + return (u32) rt; } bool tsc2007_is_pen_down(struct tsc2007 *ts)