* [PATCH] iio: tsl2583: Fix division by a zero lux_val
@ 2021-05-07 18:30 Colin King
2021-05-08 16:12 ` Jonathan Cameron
0 siblings, 1 reply; 4+ messages in thread
From: Colin King @ 2021-05-07 18:30 UTC (permalink / raw)
To: Jonathan Cameron, Lars-Peter Clausen, Nathan Chancellor,
Nick Desaulniers, Jon Brenner, linux-iio, clang-built-linux
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
The lux_val returned from tsl2583_get_lux can potentially be zero,
so check for this to avoid a division by zero and an overflowed
gain_trim_val.
Fixes clang scan-build warning:
drivers/iio/light/tsl2583.c:345:40: warning: Either the
condition 'lux_val<0' is redundant or there is division
by zero at line 345. [zerodivcond]
Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/iio/light/tsl2583.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
index 0f787bfc88fc..c9d8f07a6fcd 100644
--- a/drivers/iio/light/tsl2583.c
+++ b/drivers/iio/light/tsl2583.c
@@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
return lux_val;
}
+ /* Avoid division by zero of lux_value later on */
+ if (lux_val == 0) {
+ dev_err(&chip->client->dev,
+ "%s: lux_val of 0 will produce out of range trim_value\n",
+ __func__);
+ return -ENODATA;
+ }
+
gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
* chip->als_settings.als_gain_trim) / lux_val);
if ((gain_trim_val < 250) || (gain_trim_val > 4000)) {
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] iio: tsl2583: Fix division by a zero lux_val
2021-05-07 18:30 [PATCH] iio: tsl2583: Fix division by a zero lux_val Colin King
@ 2021-05-08 16:12 ` Jonathan Cameron
2021-05-08 17:01 ` Joe Perches
0 siblings, 1 reply; 4+ messages in thread
From: Jonathan Cameron @ 2021-05-08 16:12 UTC (permalink / raw)
To: Colin King
Cc: Lars-Peter Clausen, Nathan Chancellor, Nick Desaulniers,
Jon Brenner, linux-iio, clang-built-linux, kernel-janitors,
linux-kernel
On Fri, 7 May 2021 19:30:41 +0100
Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The lux_val returned from tsl2583_get_lux can potentially be zero,
> so check for this to avoid a division by zero and an overflowed
> gain_trim_val.
>
> Fixes clang scan-build warning:
>
> drivers/iio/light/tsl2583.c:345:40: warning: Either the
> condition 'lux_val<0' is redundant or there is division
> by zero at line 345. [zerodivcond]
>
> Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Definitely looks like it could happen so applied to the fixes-togreg branch of
iio.git and marked for stable.
Thanks,
Jonathan
> ---
> drivers/iio/light/tsl2583.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
> index 0f787bfc88fc..c9d8f07a6fcd 100644
> --- a/drivers/iio/light/tsl2583.c
> +++ b/drivers/iio/light/tsl2583.c
> @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
> return lux_val;
> }
>
> + /* Avoid division by zero of lux_value later on */
> + if (lux_val == 0) {
> + dev_err(&chip->client->dev,
> + "%s: lux_val of 0 will produce out of range trim_value\n",
> + __func__);
> + return -ENODATA;
> + }
> +
> gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
> * chip->als_settings.als_gain_trim) / lux_val);
> if ((gain_trim_val < 250) || (gain_trim_val > 4000)) {
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] iio: tsl2583: Fix division by a zero lux_val
2021-05-08 16:12 ` Jonathan Cameron
@ 2021-05-08 17:01 ` Joe Perches
2021-05-10 6:59 ` Dan Carpenter
0 siblings, 1 reply; 4+ messages in thread
From: Joe Perches @ 2021-05-08 17:01 UTC (permalink / raw)
To: Jonathan Cameron, Colin King
Cc: Lars-Peter Clausen, Nathan Chancellor, Nick Desaulniers,
Jon Brenner, linux-iio, clang-built-linux, kernel-janitors,
linux-kernel
On Sat, 2021-05-08 at 17:12 +0100, Jonathan Cameron wrote:
> On Fri, 7 May 2021 19:30:41 +0100 Colin King <colin.king@canonical.com> wrote:
[]
> > The lux_val returned from tsl2583_get_lux can potentially be zero,
> > so check for this to avoid a division by zero and an overflowed
> > gain_trim_val.
[]
> > Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
> > Signed-off-by: Colin Ian King <colin.king@canonical.com>
> Definitely looks like it could happen so applied to the fixes-togreg branch of
> iio.git and marked for stable.
[]
> > diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
[]
> > @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
> > return lux_val;
> > }
> >
> > + /* Avoid division by zero of lux_value later on */
> > + if (lux_val == 0) {
> > + dev_err(&chip->client->dev,
> > + "%s: lux_val of 0 will produce out of range trim_value\n",
> > + __func__);
> > + return -ENODATA;
> > + }
> > +
> > gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
> > * chip->als_settings.als_gain_trim) / lux_val);
Is a multiplication overflow possible here?
There are also unnecessary parentheses.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] iio: tsl2583: Fix division by a zero lux_val
2021-05-08 17:01 ` Joe Perches
@ 2021-05-10 6:59 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2021-05-10 6:59 UTC (permalink / raw)
To: Joe Perches
Cc: Jonathan Cameron, Colin King, Lars-Peter Clausen,
Nathan Chancellor, Nick Desaulniers, Jon Brenner, linux-iio,
clang-built-linux, kernel-janitors, linux-kernel
On Sat, May 08, 2021 at 10:01:14AM -0700, Joe Perches wrote:
> On Sat, 2021-05-08 at 17:12 +0100, Jonathan Cameron wrote:
> > On Fri, 7 May 2021 19:30:41 +0100 Colin King <colin.king@canonical.com> wrote:
> []
> > > The lux_val returned from tsl2583_get_lux can potentially be zero,
> > > so check for this to avoid a division by zero and an overflowed
> > > gain_trim_val.
> []
> > > Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
> > > Signed-off-by: Colin Ian King <colin.king@canonical.com>
> > Definitely looks like it could happen so applied to the fixes-togreg branch of
> > iio.git and marked for stable.
> []
> > > diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
> []
> > > @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
> > > return lux_val;
> > > }
> > >
> > > + /* Avoid division by zero of lux_value later on */
> > > + if (lux_val == 0) {
> > > + dev_err(&chip->client->dev,
> > > + "%s: lux_val of 0 will produce out of range trim_value\n",
> > > + __func__);
> > > + return -ENODATA;
> > > + }
> > > +
> > > gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
> > > * chip->als_settings.als_gain_trim) / lux_val);
>
> Is a multiplication overflow possible here?
These are chip->foo values and they ought to be trustworthy.
Of course, in real life, they can be set to INT_MAX in
in_illuminance_input_target_store() and tsl2583_write_raw so they can
overflow... Anyway, if we were going to add a check it would be at
the point where we get the number from the user and before we save it
to chip->
regards,
dan carpenter
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-05-10 7:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-07 18:30 [PATCH] iio: tsl2583: Fix division by a zero lux_val Colin King
2021-05-08 16:12 ` Jonathan Cameron
2021-05-08 17:01 ` Joe Perches
2021-05-10 6:59 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).