diff options
| author | Johannes Kirchmair <johannes.kirchmair@skidata.com> | 2025-01-29 14:51:20 +0100 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2025-09-03 07:44:00 -0700 |
| commit | 9a12e2fb3f517d5bd72efa565a8e591e6fff311c (patch) | |
| tree | 4e93535053cc2c277d20d5692f54c59624ac5207 | |
| parent | d504bbda8ca689585bdf663514a187dd3c9f0226 (diff) | |
Input: tsc2007 - prevent overflow in pressure calculation
The touch resistance calculation in the tsc2007 driver is prone to
overflow if (z2 - z1) is large and also x is reasonably big. This
overflow results in the driver emitting input events when very little
touch pressure is applied. In these events the x and y coordinates can
be substantially off.
Avoid the overflow by using u64 when calculating resistance value.
Signed-off-by: Johannes Kirchmair <johannes.kirchmair@skidata.com>
Link: https://lore.kernel.org/r/20250129-fix_tsc_calculation_overflow-v2-1-9e51333496ad@skidata.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| -rw-r--r-- | drivers/input/touchscreen/tsc2007_core.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/input/touchscreen/tsc2007_core.c b/drivers/input/touchscreen/tsc2007_core.c index 05e00a084c88..948935de894b 100644 --- a/drivers/input/touchscreen/tsc2007_core.c +++ b/drivers/input/touchscreen/tsc2007_core.c @@ -23,6 +23,7 @@ #include <linux/input.h> #include <linux/interrupt.h> #include <linux/i2c.h> +#include <linux/math64.h> #include <linux/mod_devicetable.h> #include <linux/property.h> #include <linux/platform_data/tsc2007.h> @@ -68,7 +69,7 @@ static void tsc2007_read_values(struct tsc2007 *tsc, struct ts_event *tc) u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc) { - u32 rt = 0; + u64 rt = 0; /* range filtering */ if (tc->x == MAX_12BIT) @@ -79,11 +80,13 @@ u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc) rt = tc->z2 - tc->z1; rt *= tc->x; rt *= tsc->x_plate_ohms; - rt /= tc->z1; + rt = div_u64(rt, tc->z1); rt = (rt + 2047) >> 12; } - return rt; + if (rt > U32_MAX) + return U32_MAX; + return (u32) rt; } bool tsc2007_is_pen_down(struct tsc2007 *ts) |