Input: max77693-haptic - fix potential overflow

PATCH In review Dmitry Torokhov 3 participants 3 messages Oct 28, 2014 – Oct 29, 2014

Subsystems (2)

HID Input drivers

lore

Share & tools

lore

Dmitry Torokhov

author maintainer

2014-10-28 16:43 UTC #0 lore raw

PATCH 1/1 Input: max77693-haptic - fix potential overflow

Expression haptic->pwm_dev->period * haptic->magnitude is of type 'unsigned int' and may overflow. We need to convert one of the operands to u64 before multiplying, instead of casting result (potentially overflown) to u64.

Reported by Coverity: CID 1248753

Signed-off-by Dmitry Torokhov <[email protected]>

---
 drivers/input/misc/max77693-haptic.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

drivers/input/misc/max77693-haptic.c +2 -3

index 7b1fde9..ef6a9d6 100644
@@ -194,7 +194,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
 				       struct ff_effect *effect)
 {
 	struct max77693_haptic *haptic = input_get_drvdata(dev);
-	uint64_t period_mag_multi;
+	u64 period_mag_multi;
 
 	haptic->magnitude = effect->u.rumble.strong_magnitude;
 	if (!haptic->magnitude)

@@ -205,8 +205,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
 	 * The formula to convert magnitude to pwm_duty as follows:
 	 * - pwm_duty = (magnitude * pwm_period) / MAX_MAGNITUDE(0xFFFF)
 	 */
-	period_mag_multi = (int64_t)(haptic->pwm_dev->period *
-						haptic->magnitude);
+	period_mag_multi = (u64)haptic->pwm_dev->period * haptic->magnitude;
 	haptic->pwm_duty = (unsigned int)(period_mag_multi >>
 						MAX_MAGNITUDE_SHIFT);

Signature · 5 lines

2.1.0.rc2.206.gedb03e5


-- 
Dmitry

Jaewon Kim

Acked-by on v1 1/1

2014-10-29 03:22 UTC #1 lore raw

Hi Dmitry,

2014년 10월 29일 01:43에 Dmitry Torokhov 이(가) 쓴 글:

Quoted 25 lines

Expression haptic->pwm_dev->period * haptic->magnitude is of type 'unsigned int' and may overflow. We need to convert one of the operands to u64 before multiplying, instead of casting result (potentially overflown) to u64.
Reported by Coverity: CID 1248753
Signed-off-by Dmitry Torokhov <[email protected]>
---
  drivers/input/misc/max77693-haptic.c | 5 ++---
  1 file changed, 2 insertions(+), 3 deletions(-)
drivers/input/misc/max77693-haptic.c +1 -1
index 7b1fde9..ef6a9d6 100644
@@ -194,7 +194,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
  				       struct ff_effect *effect)
  {
  	struct max77693_haptic *haptic = input_get_drvdata(dev);
-	uint64_t period_mag_multi;
+	u64 period_mag_multi;
 
  	haptic->magnitude = effect->u.rumble.strong_magnitude;
  	if (!haptic->magnitude)

drivers/input/misc/max77693-haptic.c static int max77693_haptic_play_effect(struct input_dev *dev, void *data, · line 211

Quoted 9 lines

drivers/input/misc/max77693-haptic.c +1 -2

@@ -205,8 +205,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
  	 * The formula to convert magnitude to pwm_duty as follows:
  	 * - pwm_duty = (magnitude * pwm_period) / MAX_MAGNITUDE(0xFFFF)
  	 */
-	period_mag_multi = (int64_t)(haptic->pwm_dev->period *
-						haptic->magnitude);
+	period_mag_multi = (u64)haptic->pwm_dev->period * haptic->magnitude;
  	haptic->pwm_duty = (unsigned int)(period_mag_multi >>
  						MAX_MAGNITUDE_SHIFT);

There was casting miss in multiplying.
Thanks.

Acked-by Jaewon Kim <[email protected]>

Chanwoo Choi

Reviewed-by on v1 1/1

2014-10-29 04:34 UTC #2 lore raw

In reply to Dmitry Torokhov

Quoted 26 lines · Dmitry Torokhov

Expression haptic->pwm_dev->period * haptic->magnitude is of type 'unsigned int' and may overflow. We need to convert one of the operands to u64 before multiplying, instead of casting result (potentially overflown) to u64.
Reported by Coverity: CID 1248753
Signed-off-by Dmitry Torokhov <[email protected]>
---
 drivers/input/misc/max77693-haptic.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/input/misc/max77693-haptic.c +1 -1
index 7b1fde9..ef6a9d6 100644
@@ -194,7 +194,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
 				       struct ff_effect *effect)
 {
 	struct max77693_haptic *haptic = input_get_drvdata(dev);
-	uint64_t period_mag_multi;
+	u64 period_mag_multi;
 
 	haptic->magnitude = effect->u.rumble.strong_magnitude;
 	if (!haptic->magnitude)

drivers/input/misc/max77693-haptic.c static int max77693_haptic_play_effect(struct input_dev *dev, void *data, · line 211

Quoted 9 lines

drivers/input/misc/max77693-haptic.c +1 -2

@@ -205,8 +205,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
 	 * The formula to convert magnitude to pwm_duty as follows:
 	 * - pwm_duty = (magnitude * pwm_period) / MAX_MAGNITUDE(0xFFFF)
 	 */
-	period_mag_multi = (int64_t)(haptic->pwm_dev->period *
-						haptic->magnitude);
+	period_mag_multi = (u64)haptic->pwm_dev->period * haptic->magnitude;
 	haptic->pwm_duty = (unsigned int)(period_mag_multi >>
 						MAX_MAGNITUDE_SHIFT);

Looks good to me.

Reviewed-by Chanwoo Choi <[email protected]>

Thanks,
Chanwoo Choi