Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Input: tsc2007 - prevent overflow in pressure calculation

The touch resistance calculation in the tsc2007 driver is prone to
overflow if (z2 - z1) is large and also x is reasonably big. This
overflow results in the driver emitting input events when very little
touch pressure is applied. In these events the x and y coordinates can
be substantially off.

Avoid the overflow by using u64 when calculating resistance value.

Signed-off-by: Johannes Kirchmair <johannes.kirchmair@skidata.com>
Link: https://lore.kernel.org/r/20250129-fix_tsc_calculation_overflow-v2-1-9e51333496ad@skidata.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

authored by

Johannes Kirchmair and committed by
Dmitry Torokhov
9a12e2fb d504bbda

+6 -3
+6 -3
drivers/input/touchscreen/tsc2007_core.c
··· 23 23 #include <linux/input.h> 24 24 #include <linux/interrupt.h> 25 25 #include <linux/i2c.h> 26 + #include <linux/math64.h> 26 27 #include <linux/mod_devicetable.h> 27 28 #include <linux/property.h> 28 29 #include <linux/platform_data/tsc2007.h> ··· 69 68 70 69 u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc) 71 70 { 72 - u32 rt = 0; 71 + u64 rt = 0; 73 72 74 73 /* range filtering */ 75 74 if (tc->x == MAX_12BIT) ··· 80 79 rt = tc->z2 - tc->z1; 81 80 rt *= tc->x; 82 81 rt *= tsc->x_plate_ohms; 83 - rt /= tc->z1; 82 + rt = div_u64(rt, tc->z1); 84 83 rt = (rt + 2047) >> 12; 85 84 } 86 85 87 - return rt; 86 + if (rt > U32_MAX) 87 + return U32_MAX; 88 + return (u32) rt; 88 89 } 89 90 90 91 bool tsc2007_is_pen_down(struct tsc2007 *ts)