Re: [PATCH v3] Input: elan_i2c - prevent division by zero on invalid device parameters

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

Hi Ranjan,

On Mon, May 18, 2026 at 06:26:24AM +0000, Ranjan Kumar wrote:
> The Elan I2C touchpad driver queries the device for its physical
> dimensions and trace counts to calculate the device resolution and width.
> However, if the device firmware or device tree provides invalid zero
> values for x_traces, y_traces, x_mm, or y_mm, it results in a fatal
> division-by-zero exception leading to a kernel panic during device probe.
> 
> Add sanity checks to ensure these physical parameters are non-zero
> before performing the division. If invalid trace values are detected,
> log a warning and fall back to ETP_FWIDTH_REDUCE to prevent arithmetic
> underflow during touch reporting.

I would define some defaults that are not necessarily the same as
ETP_FWIDTH_REDUCE. The arithmetic overflow should be handled separately,
as it may still happen if we read (or set up via device tree) some small
(but non-zero) values.

> For invalid physical dimensions, fall
> back to a safe default of 1.
> 
> This prevents the kernel panic while allowing the probe to complete
> successfully. Completing the probe ensures the sysfs nodes are created,
> keeping the firmware update path intact so a recovery firmware can be
> flashed to the device.
> 
> Fixes: 6696777c6506 ("Input: add driver for Elan I2C/SMbus touchpad")
> Fixes: e3a9a1290688 ("Input: elan_i2c - do not query the info if they are provided")
> Signed-off-by: Ranjan Kumar <kumarranja@chromium.org>
> ---
> Changes in v3:
>  - Changed trace fallback values from 1 to ETP_FWIDTH_REDUCE to prevent 
>    an unsigned integer underflow in elan_report_absolute(). 
>  Changes in v2:
>  - Changed error handling from aborting probe with -EINVAL to logging a
>    warning and falling back to default values.
> 
>  drivers/input/mouse/elan_i2c_core.c | 25 +++++++++++++++++++++----
>  1 file changed, 21 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
> index fee1796da3d0..c64e1dd1e60b 100644
> --- a/drivers/input/mouse/elan_i2c_core.c
> +++ b/drivers/input/mouse/elan_i2c_core.c
> @@ -425,8 +425,17 @@ static int elan_query_device_parameters(struct elan_tp_data *data)
>  		if (error)
>  			return error;
>  	}
> -	data->width_x = data->max_x / x_traces;
> -	data->width_y = data->max_y / y_traces;
> +
> +	if (unlikely(x_traces == 0 || y_traces == 0)) {

I'd say "if (!x_traces || !y_traces) ...". This is not hot path so
annotating with unlikely does not buy us anything.

I wonder if we should be comparing with some threshold instead of 0.
Something above 90 I guess.

Thanks.

-- 
Dmitry