Re: [PATCH v2] iio: hid-sensors: fix fractional part for unit exponents -7 and -8

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] iio: hid-sensors: divide by zero in convert_to_vtf_format() for exp < -6
--

commit e56afd4fc65e2d177add5e21d5704d17876c53ec
Author: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

iio: hid-sensors: fix fractional part for unit exponents -7 and -8

This commit fixes split_micro_fraction() so that HID unit exponents of -7 and
-8 divide the remainder by 10^(exp - 6) instead of passing a negative exponent
to int_pow().

> diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> index 26f8554d18a57..22d33f8c25f14 100644
> --- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> +++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> @@ -98,9 +98,14 @@ static void simple_div(int dividend, int divisor, int *whole, int *micro_frac)
>  static void split_micro_fraction(unsigned int no, int exp, int *val1, int *val2)
>  {
>  	int divisor = int_pow(10, exp);
> +	unsigned int rem;
>  
>  	*val1 = no / divisor;
> -	*val2 = no % divisor * int_pow(10, 6 - exp);
> +	rem = no % divisor;
> +	if (exp > 6)
> +		*val2 = rem / (unsigned int)int_pow(10, exp - 6);
> +	else
> +		*val2 = rem * int_pow(10, 6 - exp);
>  }

[Severity: High]
As reported by Sashiko on v1 [1], the commit message notes that dividing by
10^(exp - 6) in split_micro_fraction() matches the reverse conversion in
convert_to_vtf_format(), but does convert_to_vtf_format() also need a similar
fix for unit exponents -7 and -8?

In drivers/iio/common/hid-sensors/hid-sensor-attributes.c:

static u32 convert_to_vtf_format(int size, int exp, int val1, int val2)
{
	...
	exp = hid_sensor_convert_exponent(exp);
	if (exp < 0) {
		divisor = int_pow(10, 6 + exp);
		value = abs(val1) * int_pow(10, -exp);
		value += abs(val2) / divisor;
	}
	...
}

When hid_sensor_write_raw_hyst_value() or
hid_sensor_write_raw_hyst_rel_value() calls convert_to_vtf_format() with a
unit exponent of -7 or -8, 6 + exp is -1 or -2. Because the second parameter
of int_pow() is unsigned, int_pow(10, 6 + exp) overflows to 0 modulo 2^64,
causing abs(val2) / divisor to divide by zero in the kernel.

Should convert_to_vtf_format() multiply abs(val2) by int_pow(10, -6 - exp)
when exp < -6 instead of dividing?

[1] https://lore.kernel.org/r/20261102222309.439895-1-srinivas.pandruvada@linux.intel.com

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104165319.1890851-1-srinivas.pandruvada@linux.intel.com?part=1