| Message ID | 20210507183041.115864-1-colin.king@canonical.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | iio: tsl2583: Fix division by a zero lux_val | expand |
On Fri, 7 May 2021 19:30:41 +0100 Colin King <colin.king@canonical.com> wrote: > From: Colin Ian King <colin.king@canonical.com> > > The lux_val returned from tsl2583_get_lux can potentially be zero, > so check for this to avoid a division by zero and an overflowed > gain_trim_val. > > Fixes clang scan-build warning: > > drivers/iio/light/tsl2583.c:345:40: warning: Either the > condition 'lux_val<0' is redundant or there is division > by zero at line 345. [zerodivcond] > > Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") > Signed-off-by: Colin Ian King <colin.king@canonical.com> Definitely looks like it could happen so applied to the fixes-togreg branch of iio.git and marked for stable. Thanks, Jonathan > --- > drivers/iio/light/tsl2583.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c > index 0f787bfc88fc..c9d8f07a6fcd 100644 > --- a/drivers/iio/light/tsl2583.c > +++ b/drivers/iio/light/tsl2583.c > @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev) > return lux_val; > } > > + /* Avoid division by zero of lux_value later on */ > + if (lux_val == 0) { > + dev_err(&chip->client->dev, > + "%s: lux_val of 0 will produce out of range trim_value\n", > + __func__); > + return -ENODATA; > + } > + > gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target) > * chip->als_settings.als_gain_trim) / lux_val); > if ((gain_trim_val < 250) || (gain_trim_val > 4000)) {
On Sat, 2021-05-08 at 17:12 +0100, Jonathan Cameron wrote: > On Fri, 7 May 2021 19:30:41 +0100 Colin King <colin.king@canonical.com> wrote: [] > > The lux_val returned from tsl2583_get_lux can potentially be zero, > > so check for this to avoid a division by zero and an overflowed > > gain_trim_val. [] > > Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") > > Signed-off-by: Colin Ian King <colin.king@canonical.com> > Definitely looks like it could happen so applied to the fixes-togreg branch of > iio.git and marked for stable. [] > > diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c [] > > @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev) > > return lux_val; > > } > > > > + /* Avoid division by zero of lux_value later on */ > > + if (lux_val == 0) { > > + dev_err(&chip->client->dev, > > + "%s: lux_val of 0 will produce out of range trim_value\n", > > + __func__); > > + return -ENODATA; > > + } > > + > > gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target) > > * chip->als_settings.als_gain_trim) / lux_val); Is a multiplication overflow possible here? There are also unnecessary parentheses.
On Sat, May 08, 2021 at 10:01:14AM -0700, Joe Perches wrote: > On Sat, 2021-05-08 at 17:12 +0100, Jonathan Cameron wrote: > > On Fri, 7 May 2021 19:30:41 +0100 Colin King <colin.king@canonical.com> wrote: > [] > > > The lux_val returned from tsl2583_get_lux can potentially be zero, > > > so check for this to avoid a division by zero and an overflowed > > > gain_trim_val. > [] > > > Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") > > > Signed-off-by: Colin Ian King <colin.king@canonical.com> > > Definitely looks like it could happen so applied to the fixes-togreg branch of > > iio.git and marked for stable. > [] > > > diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c > [] > > > @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev) > > > return lux_val; > > > } > > > > > > + /* Avoid division by zero of lux_value later on */ > > > + if (lux_val == 0) { > > > + dev_err(&chip->client->dev, > > > + "%s: lux_val of 0 will produce out of range trim_value\n", > > > + __func__); > > > + return -ENODATA; > > > + } > > > + > > > gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target) > > > * chip->als_settings.als_gain_trim) / lux_val); > > Is a multiplication overflow possible here? These are chip->foo values and they ought to be trustworthy. Of course, in real life, they can be set to INT_MAX in in_illuminance_input_target_store() and tsl2583_write_raw so they can overflow... Anyway, if we were going to add a check it would be at the point where we get the number from the user and before we save it to chip-> regards, dan carpenter
diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c index 0f787bfc88fc..c9d8f07a6fcd 100644 --- a/drivers/iio/light/tsl2583.c +++ b/drivers/iio/light/tsl2583.c @@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev) return lux_val; } + /* Avoid division by zero of lux_value later on */ + if (lux_val == 0) { + dev_err(&chip->client->dev, + "%s: lux_val of 0 will produce out of range trim_value\n", + __func__); + return -ENODATA; + } + gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target) * chip->als_settings.als_gain_trim) / lux_val); if ((gain_trim_val < 250) || (gain_trim_val > 4000)) {