From: Dan Carpenter <dan.carpenter@oracle.com>
To: Joe Perches <joe@perches.com>
Cc: Jonathan Cameron <jic23@kernel.org>,
Colin King <colin.king@canonical.com>,
Lars-Peter Clausen <lars@metafoo.de>,
Nathan Chancellor <nathan@kernel.org>,
Nick Desaulniers <ndesaulniers@google.com>,
Jon Brenner <jbrenner@taosinc.com>,
linux-iio@vger.kernel.org, clang-built-linux@googlegroups.com,
kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] iio: tsl2583: Fix division by a zero lux_val
Date: Mon, 10 May 2021 09:59:28 +0300 [thread overview]
Message-ID: <20210510065928.GR1955@kadam> (raw)
In-Reply-To: <1eb0428d352be2498739de71eb65746309c90f4c.camel@perches.com>
On Sat, May 08, 2021 at 10:01:14AM -0700, Joe Perches wrote:
> On Sat, 2021-05-08 at 17:12 +0100, Jonathan Cameron wrote:
> > On Fri, 7 May 2021 19:30:41 +0100 Colin King <colin.king@canonical.com> wrote:
> []
> > > The lux_val returned from tsl2583_get_lux can potentially be zero,
> > > so check for this to avoid a division by zero and an overflowed
> > > gain_trim_val.
> []
> > > Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
> > > Signed-off-by: Colin Ian King <colin.king@canonical.com>
> > Definitely looks like it could happen so applied to the fixes-togreg branch of
> > iio.git and marked for stable.
> []
> > > diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
> []
> > > @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
> > > return lux_val;
> > > }
> > >
> > > + /* Avoid division by zero of lux_value later on */
> > > + if (lux_val == 0) {
> > > + dev_err(&chip->client->dev,
> > > + "%s: lux_val of 0 will produce out of range trim_value\n",
> > > + __func__);
> > > + return -ENODATA;
> > > + }
> > > +
> > > gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
> > > * chip->als_settings.als_gain_trim) / lux_val);
>
> Is a multiplication overflow possible here?
These are chip->foo values and they ought to be trustworthy.
Of course, in real life, they can be set to INT_MAX in
in_illuminance_input_target_store() and tsl2583_write_raw so they can
overflow... Anyway, if we were going to add a check it would be at
the point where we get the number from the user and before we save it
to chip->
regards,
dan carpenter
prev parent reply other threads:[~2021-05-10 7:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-07 18:30 [PATCH] iio: tsl2583: Fix division by a zero lux_val Colin King
2021-05-08 16:12 ` Jonathan Cameron
2021-05-08 17:01 ` Joe Perches
2021-05-10 6:59 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210510065928.GR1955@kadam \
--to=dan.carpenter@oracle.com \
--cc=clang-built-linux@googlegroups.com \
--cc=colin.king@canonical.com \
--cc=jbrenner@taosinc.com \
--cc=jic23@kernel.org \
--cc=joe@perches.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=lars@metafoo.de \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).