linux-kernel - [PATCH v1] Input: touchscreen: ads7846.c: fix integer overflow on Rt calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 13 Nov 2020 12:22:40 +0100
From:   Oleksij Rempel <o.rempel@...gutronix.de>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>,
        Alexandru Ardelean <alexandru.ardelean@...log.com>,
        Mark Brown <broonie@...nel.org>
Cc:     Oleksij Rempel <o.rempel@...gutronix.de>,
        David Jander <david@...tonic.nl>, kernel@...gutronix.de,
        linux-kernel@...r.kernel.org, linux-input@...r.kernel.org,
        linux-spi@...r.kernel.org
Subject: [PATCH v1] Input: touchscreen: ads7846.c: fix integer overflow on Rt calculation

In some rare cases the 32 bit Rt value will overflow if z2 and x is max,
z1 is minimal value and x_plate_ohms is relatively high (for example 800
ohm). This would happen on some screen age with low pressure.

There are two possible fixes:
- make Rt 64bit
- reorder calculation to avoid overflow

The second variant seems to be preferable, since 64 bit calculation on
32 bit system is a bit more expensive.

Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver")
Co-Developed-by: David Jander <david@...tonic.nl>
Signed-off-by: David Jander <david@...tonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@...gutronix.de>
---
 drivers/input/touchscreen/ads7846.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 652d9bcfdaee..78d7159e92fe 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -993,10 +993,11 @@ static void ads7846_report_state(struct ads7846 *ts)
 		/* compute touch pressure resistance using equation #2 */
 		Rt = z2;
 		Rt -= z1;
-		Rt *= x;
 		Rt *= ts->x_plate_ohms;
+		Rt = DIV_ROUND_CLOSEST(Rt, 16);
+		Rt *= x;
 		Rt /= z1;
-		Rt = (Rt + 2047) >> 12;
+		Rt = DIV_ROUND_CLOSEST(Rt, 256);
 	} else {
 		Rt = 0;
 	}
-- 
2.28.0