[PATCH v2] iio: hid-sensors: fix fractional part for unit exponents -7 and -8

[PATCH v2] iio: hid-sensors: fix fractional part for unit exponents -7 and -8

[Srinivas Pandruvada]

split_micro_fraction() scales the remainder to micro units by
multiplying it by 10^(6 - exp). The unit exponent of a HID field goes
down to -8, so exp can be 7 or 8 here. Then the argument of int_pow()
is negative, which the unsigned parameter turns into a huge power of
ten: 0 modulo 2^64. As a result, the fractional part of a value read
from the hysteresis attributes is always reported as 0.

Divide by 10^(exp - 6) in these two cases. This matches the reverse
conversion in convert_to_vtf_format().

Fixes: 73c6768b710a ("iio: hid-sensors: Common attribute and trigger")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
---
v2:
- Fix __udivdi3 link error on 32-bit by using a 32-bit divisor
- Address Andy's comment:
Keep no % divisor in a temporary variable next to no / divisor

 drivers/iio/common/hid-sensors/hid-sensor-attributes.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index 9e7c26e37880..d44091faf122 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -96,9 +96,14 @@ static void simple_div(int dividend, int divisor, int *whole, int *micro_frac)
 static void split_micro_fraction(unsigned int no, int exp, int *val1, int *val2)
 {
 	int divisor = int_pow(10, exp);
+	unsigned int rem;
 
 	*val1 = no / divisor;
-	*val2 = no % divisor * int_pow(10, 6 - exp);
+	rem = no % divisor;
+	if (exp > 6)
+		*val2 = rem / (unsigned int)int_pow(10, exp - 6);
+	else
+		*val2 = rem * int_pow(10, 6 - exp);
 }
 
 /*
-- 
2.56.0

Re: [PATCH v2] iio: hid-sensors: fix fractional part for unit exponents -7 and -8

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] iio: hid-sensors: divide by zero in convert_to_vtf_format() for exp < -6
--

commit e56afd4fc65e2d177add5e21d5704d17876c53ec
Author: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

iio: hid-sensors: fix fractional part for unit exponents -7 and -8

This commit fixes split_micro_fraction() so that HID unit exponents of -7 and
-8 divide the remainder by 10^(exp - 6) instead of passing a negative exponent
to int_pow().

> diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> index 26f8554d18a57..22d33f8c25f14 100644
> --- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> +++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> @@ -98,9 +98,14 @@ static void simple_div(int dividend, int divisor, int *whole, int *micro_frac)
>  static void split_micro_fraction(unsigned int no, int exp, int *val1, int *val2)
>  {
>  	int divisor = int_pow(10, exp);
> +	unsigned int rem;
>  
>  	*val1 = no / divisor;
> -	*val2 = no % divisor * int_pow(10, 6 - exp);
> +	rem = no % divisor;
> +	if (exp > 6)
> +		*val2 = rem / (unsigned int)int_pow(10, exp - 6);
> +	else
> +		*val2 = rem * int_pow(10, 6 - exp);
>  }

[Severity: High]
As reported by Sashiko on v1 [1], the commit message notes that dividing by
10^(exp - 6) in split_micro_fraction() matches the reverse conversion in
convert_to_vtf_format(), but does convert_to_vtf_format() also need a similar
fix for unit exponents -7 and -8?

In drivers/iio/common/hid-sensors/hid-sensor-attributes.c:

static u32 convert_to_vtf_format(int size, int exp, int val1, int val2)
{
	...
	exp = hid_sensor_convert_exponent(exp);
	if (exp < 0) {
		divisor = int_pow(10, 6 + exp);
		value = abs(val1) * int_pow(10, -exp);
		value += abs(val2) / divisor;
	}
	...
}

When hid_sensor_write_raw_hyst_value() or
hid_sensor_write_raw_hyst_rel_value() calls convert_to_vtf_format() with a
unit exponent of -7 or -8, 6 + exp is -1 or -2. Because the second parameter
of int_pow() is unsigned, int_pow(10, 6 + exp) overflows to 0 modulo 2^64,
causing abs(val2) / divisor to divide by zero in the kernel.

Should convert_to_vtf_format() multiply abs(val2) by int_pow(10, -6 - exp)
when exp < -6 instead of dividing?

[1] https://lore.kernel.org/r/20261102222309.439895-1-srinivas.pandruvada@linux.intel.com

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104165319.1890851-1-srinivas.pandruvada@linux.intel.com?part=1

Re: [PATCH v2] iio: hid-sensors: fix fractional part for unit exponents -7 and -8

[srinivas pandruvada]

On Wed, 2026-11-04 at 17:07 +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue(s) to consider:
> - [High] iio: hid-sensors: divide by zero in convert_to_vtf_format()
> for exp < -6
> --
> 
> commit e56afd4fc65e2d177add5e21d5704d17876c53ec
> Author: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
> 
> iio: hid-sensors: fix fractional part for unit exponents -7 and -8
> 
> This commit fixes split_micro_fraction() so that HID unit exponents
> of -7 and
> -8 divide the remainder by 10^(exp - 6) instead of passing a negative
> exponent
> to int_pow().
> 
> > diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > index 26f8554d18a57..22d33f8c25f14 100644
> > --- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > +++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > @@ -98,9 +98,14 @@ static void simple_div(int dividend, int
> > divisor, int *whole, int *micro_frac)
> >  static void split_micro_fraction(unsigned int no, int exp, int
> > *val1, int *val2)
> >  {
> >  	int divisor = int_pow(10, exp);
> > +	unsigned int rem;
> >  
> >  	*val1 = no / divisor;
> > -	*val2 = no % divisor * int_pow(10, 6 - exp);
> > +	rem = no % divisor;
> > +	if (exp > 6)
> > +		*val2 = rem / (unsigned int)int_pow(10, exp - 6);
> > +	else
> > +		*val2 = rem * int_pow(10, 6 - exp);
> >  }
> 
> [Severity: High]
> As reported by Sashiko on v1 [1], the commit message notes that
> dividing by
> 10^(exp - 6) in split_micro_fraction() matches the reverse conversion
> in
> convert_to_vtf_format(), but does convert_to_vtf_format() also need a
> similar
> fix for unit exponents -7 and -8?
> 

This patch is a follow up patch [PATCH 11/15] iio: hid-sensors: fix a
division by zero posted by Josef Bacik <josef@toxicpanda.com>, which
did this change..

> In drivers/iio/common/hid-sensors/hid-sensor-attributes.c:
> 
> static u32 convert_to_vtf_format(int size, int exp, int val1, int
> val2)
> {
> 	...
> 	exp = hid_sensor_convert_exponent(exp);
> 	if (exp < 0) {
> 		divisor = int_pow(10, 6 + exp);
> 		value = abs(val1) * int_pow(10, -exp);
> 		value += abs(val2) / divisor;
> 	}
> 	...
> }
> 
> When hid_sensor_write_raw_hyst_value() or
> hid_sensor_write_raw_hyst_rel_value() calls convert_to_vtf_format()
> with a
> unit exponent of -7 or -8, 6 + exp is -1 or -2. Because the second
> parameter
> of int_pow() is unsigned, int_pow(10, 6 + exp) overflows to 0 modulo
> 2^64,
> causing abs(val2) / divisor to divide by zero in the kernel.
> 
> Should convert_to_vtf_format() multiply abs(val2) by int_pow(10, -6 -
> exp)
> when exp < -6 instead of dividing?
> 
> [1]
> https://lore.kernel.org/r/20261102222309.439895-1-srinivas.pandruvada@linux.intel.com

Re: [PATCH v2] iio: hid-sensors: fix fractional part for unit exponents -7 and -8

[Семён Марьясин]

Tested-by: Semyon Maryasin <simeon@maryasin.name>

Here is what I observe with this patch:
1. Enable sensor and run xxd /dev/HID-SENSOR-2000e1.3.auto
2. In the second terminal, do rmmod intel_ishtp_hid
3. Observed result: xxd stops with "xxd: No such device"
4. At the same time, in kernel logs I see the following:

ноя 05 22:19:16 dook kernel: hid-sensor-hub 001F:8087:0AC2.0005:
timeout waiting for response from ISHTP device
ноя 05 22:19:19 dook kernel: hid-sensor-hub 001F:8087:0AC2.0005:
timeout waiting for response from ISHTP device
ноя 05 22:19:22 dook kernel: hid-sensor-hub 001F:8087:0AC2.0006:
timeout waiting for response from ISHTP device
ноя 05 22:19:25 dook kernel: hid-sensor-hub 001F:8087:0AC2.0006:
timeout waiting for response from ISHTP device

No system crash, so I suppose this is okay?

After subsequent modprobe the sensor initializes and works properly.
No kernel crash with this patch.

ср, 4 нояб. 2026 г. в 19:53, Srinivas Pandruvada
<srinivas.pandruvada@linux.intel.com>:
>
> split_micro_fraction() scales the remainder to micro units by
> multiplying it by 10^(6 - exp). The unit exponent of a HID field goes
> down to -8, so exp can be 7 or 8 here. Then the argument of int_pow()
> is negative, which the unsigned parameter turns into a huge power of
> ten: 0 modulo 2^64. As a result, the fractional part of a value read
> from the hysteresis attributes is always reported as 0.
>
> Divide by 10^(exp - 6) in these two cases. This matches the reverse
> conversion in convert_to_vtf_format().
>
> Fixes: 73c6768b710a ("iio: hid-sensors: Common attribute and trigger")
> Cc: stable@vger.kernel.org
> Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
> ---
> v2:
> - Fix __udivdi3 link error on 32-bit by using a 32-bit divisor
> - Address Andy's comment:
> Keep no % divisor in a temporary variable next to no / divisor
>
>  drivers/iio/common/hid-sensors/hid-sensor-attributes.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> index 9e7c26e37880..d44091faf122 100644
> --- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> +++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> @@ -96,9 +96,14 @@ static void simple_div(int dividend, int divisor, int *whole, int *micro_frac)
>  static void split_micro_fraction(unsigned int no, int exp, int *val1, int *val2)
>  {
>         int divisor = int_pow(10, exp);
> +       unsigned int rem;
>
>         *val1 = no / divisor;
> -       *val2 = no % divisor * int_pow(10, 6 - exp);
> +       rem = no % divisor;
> +       if (exp > 6)
> +               *val2 = rem / (unsigned int)int_pow(10, exp - 6);
> +       else
> +               *val2 = rem * int_pow(10, 6 - exp);
>  }
>
>  /*
> --
> 2.56.0
>
>


-- 
С уважением,
Семён Марьясин

Re: [PATCH v2] iio: hid-sensors: fix fractional part for unit exponents -7 and -8

[Srinivas Pandruvada]

On Thu, 2026-11-05 at 22:26 +0300, Семён Марьясин wrote:
> Tested-by: Semyon Maryasin <simeon@maryasin.name>
> 
> Here is what I observe with this patch:
> 1. Enable sensor and run xxd /dev/HID-SENSOR-2000e1.3.auto
> 2. In the second terminal, do rmmod intel_ishtp_hid
> 3. Observed result: xxd stops with "xxd: No such device"
> 4. At the same time, in kernel logs I see the following:
> 
> ноя 05 22:19:16 dook kernel: hid-sensor-hub 001F:8087:0AC2.0005:
> timeout waiting for response from ISHTP device
> ноя 05 22:19:19 dook kernel: hid-sensor-hub 001F:8087:0AC2.0005:
> timeout waiting for response from ISHTP device
> ноя 05 22:19:22 dook kernel: hid-sensor-hub 001F:8087:0AC2.0006:
> timeout waiting for response from ISHTP device
> ноя 05 22:19:25 dook kernel: hid-sensor-hub 001F:8087:0AC2.0006:
> timeout waiting for response from ISHTP device
> 
> No system crash, so I suppose this is okay?
> 
That is fine.

Thanks,
Srinivas


> After subsequent modprobe the sensor initializes and works properly.
> No kernel crash with this patch.
> 
> ср, 4 нояб. 2026 г. в 19:53, Srinivas Pandruvada
> <srinivas.pandruvada@linux.intel.com>:
> > 
> > split_micro_fraction() scales the remainder to micro units by
> > multiplying it by 10^(6 - exp). The unit exponent of a HID field
> > goes
> > down to -8, so exp can be 7 or 8 here. Then the argument of
> > int_pow()
> > is negative, which the unsigned parameter turns into a huge power
> > of
> > ten: 0 modulo 2^64. As a result, the fractional part of a value
> > read
> > from the hysteresis attributes is always reported as 0.
> > 
> > Divide by 10^(exp - 6) in these two cases. This matches the reverse
> > conversion in convert_to_vtf_format().
> > 
> > Fixes: 73c6768b710a ("iio: hid-sensors: Common attribute and
> > trigger")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Srinivas Pandruvada
> > <srinivas.pandruvada@linux.intel.com>
> > ---
> > v2:
> > - Fix __udivdi3 link error on 32-bit by using a 32-bit divisor
> > - Address Andy's comment:
> > Keep no % divisor in a temporary variable next to no / divisor
> > 
> >  drivers/iio/common/hid-sensors/hid-sensor-attributes.c | 7 ++++++-
> >  1 file changed, 6 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > index 9e7c26e37880..d44091faf122 100644
> > --- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > +++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > @@ -96,9 +96,14 @@ static void simple_div(int dividend, int
> > divisor, int *whole, int *micro_frac)
> >  static void split_micro_fraction(unsigned int no, int exp, int
> > *val1, int *val2)
> >  {
> >         int divisor = int_pow(10, exp);
> > +       unsigned int rem;
> > 
> >         *val1 = no / divisor;
> > -       *val2 = no % divisor * int_pow(10, 6 - exp);
> > +       rem = no % divisor;
> > +       if (exp > 6)
> > +               *val2 = rem / (unsigned int)int_pow(10, exp - 6);
> > +       else
> > +               *val2 = rem * int_pow(10, 6 - exp);
> >  }
> > 
> >  /*
> > --
> > 2.56.0
> > 
> > 
> 

Re: [PATCH v2] iio: hid-sensors: fix fractional part for unit exponents -7 and -8

[Jonathan Cameron]

On Thu, 05 Nov 2026 15:56:26 -0800
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> wrote:

> On Thu, 2026-11-05 at 22:26 +0300, Семён Марьясин wrote:
> > Tested-by: Semyon Maryasin <simeon@maryasin.name>
> > 
> > Here is what I observe with this patch:
> > 1. Enable sensor and run xxd /dev/HID-SENSOR-2000e1.3.auto
> > 2. In the second terminal, do rmmod intel_ishtp_hid
> > 3. Observed result: xxd stops with "xxd: No such device"
> > 4. At the same time, in kernel logs I see the following:
> > 
> > ноя 05 22:19:16 dook kernel: hid-sensor-hub 001F:8087:0AC2.0005:
> > timeout waiting for response from ISHTP device
> > ноя 05 22:19:19 dook kernel: hid-sensor-hub 001F:8087:0AC2.0005:
> > timeout waiting for response from ISHTP device
> > ноя 05 22:19:22 dook kernel: hid-sensor-hub 001F:8087:0AC2.0006:
> > timeout waiting for response from ISHTP device
> > ноя 05 22:19:25 dook kernel: hid-sensor-hub 001F:8087:0AC2.0006:
> > timeout waiting for response from ISHTP device
> > 
> > No system crash, so I suppose this is okay?
> >   
> That is fine.
Applied to the fixes-togreg branch of iio.git.

Thanks,

Jonathan

> 
> Thanks,
> Srinivas
> 
> 
> > After subsequent modprobe the sensor initializes and works properly.
> > No kernel crash with this patch.
> > 
> > ср, 4 нояб. 2026 г. в 19:53, Srinivas Pandruvada
> > <srinivas.pandruvada@linux.intel.com>:  
> > > 
> > > split_micro_fraction() scales the remainder to micro units by
> > > multiplying it by 10^(6 - exp). The unit exponent of a HID field
> > > goes
> > > down to -8, so exp can be 7 or 8 here. Then the argument of
> > > int_pow()
> > > is negative, which the unsigned parameter turns into a huge power
> > > of
> > > ten: 0 modulo 2^64. As a result, the fractional part of a value
> > > read
> > > from the hysteresis attributes is always reported as 0.
> > > 
> > > Divide by 10^(exp - 6) in these two cases. This matches the reverse
> > > conversion in convert_to_vtf_format().
> > > 
> > > Fixes: 73c6768b710a ("iio: hid-sensors: Common attribute and
> > > trigger")
> > > Cc: stable@vger.kernel.org
> > > Signed-off-by: Srinivas Pandruvada
> > > <srinivas.pandruvada@linux.intel.com>
> > > ---
> > > v2:
> > > - Fix __udivdi3 link error on 32-bit by using a 32-bit divisor
> > > - Address Andy's comment:
> > > Keep no % divisor in a temporary variable next to no / divisor
> > > 
> > >  drivers/iio/common/hid-sensors/hid-sensor-attributes.c | 7 ++++++-
> > >  1 file changed, 6 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > > b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > > index 9e7c26e37880..d44091faf122 100644
> > > --- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > > +++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > > @@ -96,9 +96,14 @@ static void simple_div(int dividend, int
> > > divisor, int *whole, int *micro_frac)
> > >  static void split_micro_fraction(unsigned int no, int exp, int
> > > *val1, int *val2)
> > >  {
> > >         int divisor = int_pow(10, exp);
> > > +       unsigned int rem;
> > > 
> > >         *val1 = no / divisor;
> > > -       *val2 = no % divisor * int_pow(10, 6 - exp);
> > > +       rem = no % divisor;
> > > +       if (exp > 6)
> > > +               *val2 = rem / (unsigned int)int_pow(10, exp - 6);
> > > +       else
> > > +               *val2 = rem * int_pow(10, 6 - exp);
> > >  }
> > > 
> > >  /*
> > > --
> > > 2.56.0
> > > 
> > >   
> >