diff mbox series

tsc2007: prevent overflow in pressure calculation

Message ID 20250129-fix_tsc_calculation_overflow-v1-1-3a6e388637c4@skidata.com
State New
Headers show
Series tsc2007: prevent overflow in pressure calculation | expand

Commit Message

mailinglist1@johanneskirchmair.de Jan. 29, 2025, 11:56 a.m. UTC 
From: Johannes Kirchmair <johannes.kirchmair@skidata.com>

The touch resistance calculation in the tsc2007 driver is prone to overflow
if (z2 - z1) is large and also x is reasonably big. As an result the
driver sometimes emit input events even with very little touch pressure
applied. For those events the x and y coordinates can be substantially
off. We fix the overflow problematic by calculating in a bigger int
type.

Signed-off-by: Johannes Kirchmair <johannes.kirchmair@skidata.com>
---
 drivers/input/touchscreen/tsc2007_core.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)


---
base-commit: 05dbaf8dd8bf537d4b4eb3115ab42a5fb40ff1f5
change-id: 20250129-fix_tsc_calculation_overflow-90860d4e3492

Best regards,
diff mbox series

Patch

diff --git a/drivers/input/touchscreen/tsc2007_core.c b/drivers/input/touchscreen/tsc2007_core.c
index 8d832a372b89..80abbccd1feb 100644
--- a/drivers/input/touchscreen/tsc2007_core.c
+++ b/drivers/input/touchscreen/tsc2007_core.c
@@ -68,11 +68,12 @@  static void tsc2007_read_values(struct tsc2007 *tsc, struct ts_event *tc)
 
 u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)
 {
-	u32 rt = 0;
+	u64 rt = 0;
 
 	/* range filtering */
-	if (tc->x == MAX_12BIT)
+	if (tc->x == MAX_12BIT) {
 		tc->x = 0;
+	}
 
 	if (likely(tc->x && tc->z1)) {
 		/* compute touch resistance using equation #1 */
@@ -83,7 +84,9 @@  u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)
 		rt = (rt + 2047) >> 12;
 	}
 
-	return rt;
+	if (rt > U32_MAX)
+		return U32_MAX;
+	return (u32) rt;
 }
 
 bool tsc2007_is_pen_down(struct tsc2007 *ts)