[PATCH v2] tsc2007: prevent overflow in pressure calculation

[PATCH v2] tsc2007: prevent overflow in pressure calculation

[mailinglist1]

From: Johannes Kirchmair <johannes.kirchmair@skidata.com>

The touch resistance calculation in the tsc2007 driver is prone to overflow
if (z2 - z1) is large and also x is reasonably big. As an result the
driver sometimes emit input events even with very little touch pressure
applied. For those events the x and y coordinates can be substantially
off. We fix the overflow problematic by calculating in a bigger int
type.

Signed-off-by: Johannes Kirchmair <johannes.kirchmair@skidata.com>
---
Changes in v2:
- removed brackets that slipped in
- use div_u64
---
 drivers/input/touchscreen/tsc2007_core.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/input/touchscreen/tsc2007_core.c b/drivers/input/touchscreen/tsc2007_core.c
index 8d832a372b89..0b5934d843b9 100644
--- a/drivers/input/touchscreen/tsc2007_core.c
+++ b/drivers/input/touchscreen/tsc2007_core.c
@@ -23,6 +23,7 @@
 #include <linux/input.h>
 #include <linux/interrupt.h>
 #include <linux/i2c.h>
+#include <linux/math64.h>
 #include <linux/mod_devicetable.h>
 #include <linux/property.h>
 #include <linux/platform_data/tsc2007.h>
@@ -68,7 +69,7 @@ static void tsc2007_read_values(struct tsc2007 *tsc, struct ts_event *tc)
 
 u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)
 {
-	u32 rt = 0;
+	u64 rt = 0;
 
 	/* range filtering */
 	if (tc->x == MAX_12BIT)
@@ -79,11 +80,13 @@ u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)
 		rt = tc->z2 - tc->z1;
 		rt *= tc->x;
 		rt *= tsc->x_plate_ohms;
-		rt /= tc->z1;
+		rt = div_u64(rt, tc->z1);
 		rt = (rt + 2047) >> 12;
 	}
 
-	return rt;
+	if (rt > U32_MAX)
+		return U32_MAX;
+	return (u32) rt;
 }
 
 bool tsc2007_is_pen_down(struct tsc2007 *ts)

---
base-commit: 05dbaf8dd8bf537d4b4eb3115ab42a5fb40ff1f5
change-id: 20250129-fix_tsc_calculation_overflow-90860d4e3492

Best regards,
-- 
Johannes Kirchmair <johannes.kirchmair@skidata.com>

AW: [PATCH v2] tsc2007: prevent overflow in pressure calculation

[Johannes Kirchmair - SKIDATA]

Hello,

just a friendly ping :-)

Best regards Johannes 

> -----Ursprüngliche Nachricht-----
> Von: mailinglist1@johanneskirchmair.de
> <mailinglist1@johanneskirchmair.de>
> Gesendet: Mittwoch, 29. Jänner 2025 14:51
> An: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Cc: linux-input@vger.kernel.org; Johannes Kirchmair - SKIDATA
> <johannes.kirchmair@skidata.com>
> Betreff: [PATCH v2] tsc2007: prevent overflow in pressure calculation
> 
> Caution: This is an external email, please take care when clicking links or
> opening attachments
> 
> From: Johannes Kirchmair <johannes.kirchmair@skidata.com>
> 
> The touch resistance calculation in the tsc2007 driver is prone to overflow if
> (z2 - z1) is large and also x is reasonably big. As an result the driver
> sometimes emit input events even with very little touch pressure applied. For
> those events the x and y coordinates can be substantially off. We fix the
> overflow problematic by calculating in a bigger int type.
> 
> Signed-off-by: Johannes Kirchmair <johannes.kirchmair@skidata.com>
> ---
> Changes in v2:
> - removed brackets that slipped in
> - use div_u64
> ---
>  drivers/input/touchscreen/tsc2007_core.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/input/touchscreen/tsc2007_core.c
> b/drivers/input/touchscreen/tsc2007_core.c
> index 8d832a372b89..0b5934d843b9 100644
> --- a/drivers/input/touchscreen/tsc2007_core.c
> +++ b/drivers/input/touchscreen/tsc2007_core.c
> @@ -23,6 +23,7 @@
>  #include <linux/input.h>
>  #include <linux/interrupt.h>
>  #include <linux/i2c.h>
> +#include <linux/math64.h>
>  #include <linux/mod_devicetable.h>
>  #include <linux/property.h>
>  #include <linux/platform_data/tsc2007.h> @@ -68,7 +69,7 @@ static void
> tsc2007_read_values(struct tsc2007 *tsc, struct ts_event *tc)
> 
>  u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)  {
> -       u32 rt = 0;
> +       u64 rt = 0;
> 
>         /* range filtering */
>         if (tc->x == MAX_12BIT)
> @@ -79,11 +80,13 @@ u32 tsc2007_calculate_resistance(struct tsc2007 *tsc,
> struct ts_event *tc)
>                 rt = tc->z2 - tc->z1;
>                 rt *= tc->x;
>                 rt *= tsc->x_plate_ohms;
> -               rt /= tc->z1;
> +               rt = div_u64(rt, tc->z1);
>                 rt = (rt + 2047) >> 12;
>         }
> 
> -       return rt;
> +       if (rt > U32_MAX)
> +               return U32_MAX;
> +       return (u32) rt;
>  }
> 
>  bool tsc2007_is_pen_down(struct tsc2007 *ts)
> 
> ---
> base-commit: 05dbaf8dd8bf537d4b4eb3115ab42a5fb40ff1f5
> change-id: 20250129-fix_tsc_calculation_overflow-90860d4e3492
> 
> Best regards,
> --
> Johannes Kirchmair <johannes.kirchmair@skidata.com>

Re: [PATCH v2] tsc2007: prevent overflow in pressure calculation

[Dmitry Torokhov]

On Wed, Jan 29, 2025 at 02:51:20PM +0100, mailinglist1@johanneskirchmair.de wrote:
> From: Johannes Kirchmair <johannes.kirchmair@skidata.com>
> 
> The touch resistance calculation in the tsc2007 driver is prone to overflow
> if (z2 - z1) is large and also x is reasonably big. As an result the
> driver sometimes emit input events even with very little touch pressure
> applied. For those events the x and y coordinates can be substantially
> off. We fix the overflow problematic by calculating in a bigger int
> type.
> 
> Signed-off-by: Johannes Kirchmair <johannes.kirchmair@skidata.com>

Applied, thank you.

-- 
Dmitry