[PATCH] iio: tsl2583: Fix division by a zero lux_val

[PATCH] iio: tsl2583: Fix division by a zero lux_val

[Colin King]

From: Colin Ian King <colin.king@canonical.com>

The lux_val returned from tsl2583_get_lux can potentially be zero,
so check for this to avoid a division by zero and an overflowed
gain_trim_val.

Fixes clang scan-build warning:

drivers/iio/light/tsl2583.c:345:40: warning: Either the
condition 'lux_val<0' is redundant or there is division
by zero at line 345. [zerodivcond]

Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/iio/light/tsl2583.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
index 0f787bfc88fc..c9d8f07a6fcd 100644
--- a/drivers/iio/light/tsl2583.c
+++ b/drivers/iio/light/tsl2583.c
@@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
 		return lux_val;
 	}
 
+	/* Avoid division by zero of lux_value later on */
+	if (lux_val == 0) {
+		dev_err(&chip->client->dev,
+			"%s: lux_val of 0 will produce out of range trim_value\n",
+			__func__);
+		return -ENODATA;
+	}
+
 	gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
 			* chip->als_settings.als_gain_trim) / lux_val);
 	if ((gain_trim_val < 250) || (gain_trim_val > 4000)) {
-- 
2.30.2

Re: [PATCH] iio: tsl2583: Fix division by a zero lux_val

[Jonathan Cameron]

On Fri,  7 May 2021 19:30:41 +0100
Colin King <colin.king@canonical.com> wrote:

> From: Colin Ian King <colin.king@canonical.com>
> 
> The lux_val returned from tsl2583_get_lux can potentially be zero,
> so check for this to avoid a division by zero and an overflowed
> gain_trim_val.
> 
> Fixes clang scan-build warning:
> 
> drivers/iio/light/tsl2583.c:345:40: warning: Either the
> condition 'lux_val<0' is redundant or there is division
> by zero at line 345. [zerodivcond]
> 
> Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Definitely looks like it could happen so applied to the fixes-togreg branch of
iio.git and marked for stable.

Thanks,

Jonathan
> ---
>  drivers/iio/light/tsl2583.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
> index 0f787bfc88fc..c9d8f07a6fcd 100644
> --- a/drivers/iio/light/tsl2583.c
> +++ b/drivers/iio/light/tsl2583.c
> @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
>  		return lux_val;
>  	}
>  
> +	/* Avoid division by zero of lux_value later on */
> +	if (lux_val == 0) {
> +		dev_err(&chip->client->dev,
> +			"%s: lux_val of 0 will produce out of range trim_value\n",
> +			__func__);
> +		return -ENODATA;
> +	}
> +
>  	gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
>  			* chip->als_settings.als_gain_trim) / lux_val);
>  	if ((gain_trim_val < 250) || (gain_trim_val > 4000)) {

Re: [PATCH] iio: tsl2583: Fix division by a zero lux_val

[Joe Perches]

On Sat, 2021-05-08 at 17:12 +0100, Jonathan Cameron wrote:
> On Fri,  7 May 2021 19:30:41 +0100 Colin King <colin.king@canonical.com> wrote:
[]
> > The lux_val returned from tsl2583_get_lux can potentially be zero,
> > so check for this to avoid a division by zero and an overflowed
> > gain_trim_val.
[]
> > Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
> > Signed-off-by: Colin Ian King <colin.king@canonical.com>
> Definitely looks like it could happen so applied to the fixes-togreg branch of
> iio.git and marked for stable.
[]
> > diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
[]
> > @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
> >  		return lux_val;
> >  	}
> > 
> > +	/* Avoid division by zero of lux_value later on */
> > +	if (lux_val == 0) {
> > +		dev_err(&chip->client->dev,
> > +			"%s: lux_val of 0 will produce out of range trim_value\n",
> > +			__func__);
> > +		return -ENODATA;
> > +	}
> > +
> >  	gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
> >  			* chip->als_settings.als_gain_trim) / lux_val);

Is a multiplication overflow possible here?
There are also unnecessary parentheses.

Re: [PATCH] iio: tsl2583: Fix division by a zero lux_val

[Dan Carpenter]

On Sat, May 08, 2021 at 10:01:14AM -0700, Joe Perches wrote:
> On Sat, 2021-05-08 at 17:12 +0100, Jonathan Cameron wrote:
> > On Fri,  7 May 2021 19:30:41 +0100 Colin King <colin.king@canonical.com> wrote:
> []
> > > The lux_val returned from tsl2583_get_lux can potentially be zero,
> > > so check for this to avoid a division by zero and an overflowed
> > > gain_trim_val.
> []
> > > Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
> > > Signed-off-by: Colin Ian King <colin.king@canonical.com>
> > Definitely looks like it could happen so applied to the fixes-togreg branch of
> > iio.git and marked for stable.
> []
> > > diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
> []
> > > @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
> > >  		return lux_val;
> > >  	}
> > > 
> > > +	/* Avoid division by zero of lux_value later on */
> > > +	if (lux_val == 0) {
> > > +		dev_err(&chip->client->dev,
> > > +			"%s: lux_val of 0 will produce out of range trim_value\n",
> > > +			__func__);
> > > +		return -ENODATA;
> > > +	}
> > > +
> > >  	gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
> > >  			* chip->als_settings.als_gain_trim) / lux_val);
> 
> Is a multiplication overflow possible here?

These are chip->foo values and they ought to be trustworthy.

Of course, in real life, they can be set to INT_MAX in
in_illuminance_input_target_store() and tsl2583_write_raw so they can
overflow...  Anyway, if we were going to add a check it would be at
the point where we get the number from the user and before we save it
to chip->

regards,
dan carpenter