From: Johannes Kirchmair <johannes.kirchmair@xxxxxxxxxxx>
The touch resistance calculation in the tsc2007 driver is prone to overflow
if (z2 - z1) is large and also x is reasonably big. As an result the
driver sometimes emit input events even with very little touch pressure
applied. For those events the x and y coordinates can be substantially
off. We fix the overflow problematic by calculating in a bigger int
type.
Signed-off-by: Johannes Kirchmair <johannes.kirchmair@xxxxxxxxxxx>
---
Changes in v2:
- removed brackets that slipped in
- use div_u64
---
drivers/input/touchscreen/tsc2007_core.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/input/touchscreen/tsc2007_core.c b/drivers/input/touchscreen/tsc2007_core.c
index 8d832a372b89..0b5934d843b9 100644
--- a/drivers/input/touchscreen/tsc2007_core.c
+++ b/drivers/input/touchscreen/tsc2007_core.c
@@ -23,6 +23,7 @@
#include <linux/input.h>
#include <linux/interrupt.h>
#include <linux/i2c.h>
+#include <linux/math64.h>
#include <linux/mod_devicetable.h>
#include <linux/property.h>
#include <linux/platform_data/tsc2007.h>
@@ -68,7 +69,7 @@ static void tsc2007_read_values(struct tsc2007 *tsc, struct ts_event *tc)
u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)
{
- u32 rt = 0;
+ u64 rt = 0;
/* range filtering */
if (tc->x == MAX_12BIT)
@@ -79,11 +80,13 @@ u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)
rt = tc->z2 - tc->z1;
rt *= tc->x;
rt *= tsc->x_plate_ohms;
- rt /= tc->z1;
+ rt = div_u64(rt, tc->z1);
rt = (rt + 2047) >> 12;
}
- return rt;
+ if (rt > U32_MAX)
+ return U32_MAX;
+ return (u32) rt;
}
bool tsc2007_is_pen_down(struct tsc2007 *ts)
---
base-commit: 05dbaf8dd8bf537d4b4eb3115ab42a5fb40ff1f5
change-id: 20250129-fix_tsc_calculation_overflow-90860d4e3492
Best regards,
--
Johannes Kirchmair <johannes.kirchmair@xxxxxxxxxxx>
