Re: [PATCH] Input: tsc2007 - Read "ti,poll-period" as u32

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] A 'ti,poll-period' value of 0 causes an infinite polling loop in tsc2007_soft_irq().
--

commit dfcc8705b785de318165f57112a4d5c957e4ec74
Author: Rob Herring (Arm) <robh@kernel.org>

Input: tsc2007 - Read "ti,poll-period" as u32

The "ti,poll-period" property is documented as a normal uint32 cell.
The driver used a u64 helper, which makes the helper type disagree with
the schema even though the stored value is still small.

Read "ti,poll-period" with the u32 helper matching the documented DT
cell size.

> diff --git a/drivers/input/touchscreen/tsc2007_core.c b/drivers/input/touchscreen/tsc2007_core.c
> --- a/drivers/input/touchscreen/tsc2007_core.c
> +++ b/drivers/input/touchscreen/tsc2007_core.c

[ ... ]

> @@ -238,8 +237,8 @@ static int tsc2007_probe_properties(struct device *dev, struct tsc2007 *ts)
>  	if (!device_property_read_u32(dev, "ti,fuzzz", &val32))
>  		ts->fuzzz = val32;
>  
> -	if (!device_property_read_u64(dev, "ti,poll-period", &val64))
> -		ts->poll_period = msecs_to_jiffies(val64);
> +	if (!device_property_read_u32(dev, "ti,poll-period", &val32))
> +		ts->poll_period = msecs_to_jiffies(val32);

[Severity: High]
Does this change unintentionally allow ts->poll_period to become 0, leading to
an infinite loop in tsc2007_soft_irq()?

Previously, if a 32-bit zero value was provided in the device tree,
device_property_read_u64() would fail due to a length mismatch, triggering
the fallback to a safe 1 jiffy (ts->poll_period = msecs_to_jiffies(1)).

With this fix, a 32-bit zero is successfully parsed, setting
ts->poll_period = 0.

If ts->poll_period is 0, wait_event_timeout(ts->wait, ts->stopped,
ts->poll_period) in tsc2007_soft_irq() evaluates the timeout as 0 and returns
immediately without sleeping. This results in the thread spinning in a tight
loop as long as the touchscreen is pressed.

Should we sanitize a 0 value here so it defaults to 1?

>  	else
>  		ts->poll_period = msecs_to_jiffies(1);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612215033.1885245-1-robh@kernel.org?part=1