From 9a12e2fb3f517d5bd72efa565a8e591e6fff311c Mon Sep 17 00:00:00 2001 From: Johannes Kirchmair Date: Wed, 29 Jan 2025 14:51:20 +0100 Subject: [PATCH] Input: tsc2007 - prevent overflow in pressure calculation The touch resistance calculation in the tsc2007 driver is prone to overflow if (z2 - z1) is large and also x is reasonably big. This overflow results in the driver emitting input events when very little touch pressure is applied. In these events the x and y coordinates can be substantially off. Avoid the overflow by using u64 when calculating resistance value. Signed-off-by: Johannes Kirchmair Link: https://lore.kernel.org/r/20250129-fix_tsc_calculation_overflow-v2-1-9e51333496ad@skidata.com Signed-off-by: Dmitry Torokhov --- drivers/input/touchscreen/tsc2007_core.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/input/touchscreen/tsc2007_core.c b/drivers/input/touchscreen/tsc2007_core.c index 05e00a084c88d..948935de894bf 100644 --- a/drivers/input/touchscreen/tsc2007_core.c +++ b/drivers/input/touchscreen/tsc2007_core.c @@ -23,6 +23,7 @@ #include #include #include +#include #include #include #include @@ -68,7 +69,7 @@ static void tsc2007_read_values(struct tsc2007 *tsc, struct ts_event *tc) u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc) { - u32 rt = 0; + u64 rt = 0; /* range filtering */ if (tc->x == MAX_12BIT) @@ -79,11 +80,13 @@ u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc) rt = tc->z2 - tc->z1; rt *= tc->x; rt *= tsc->x_plate_ohms; - rt /= tc->z1; + rt = div_u64(rt, tc->z1); rt = (rt + 2047) >> 12; } - return rt; + if (rt > U32_MAX) + return U32_MAX; + return (u32) rt; } bool tsc2007_is_pen_down(struct tsc2007 *ts) -- 2.47.3