From nobody Fri Jun 12 12:45:07 2026 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E88CE3CC31A for ; Fri, 15 May 2026 06:56:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778828176; cv=none; b=iyVVXT5OPlK6A65KVA2AM/jk05lfZEJsl8ZytbzMiP4qK9bzEYnO62euKkMvqkRiaRCfwt/lm6WweNUFVc0fbhNSEieSuNs4qiE9XJPlqO99+q6GxrbNwJWr3ZZzZfxyt24IrTVXGzyZCijgTxqzB/BOw686ppaoXvv9wEStzaA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778828176; c=relaxed/simple; bh=6JtnPIk9pt5yNv5Zwo+M8IPxJi0/Vqhv8YUANrQafBs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=H1scXRmRTS7yeQtd3B7qsVeOmmxHUML6jhdzlyr71O4E1w9USnRWCppNrdLPY4Rfb2eBPrT3bVnqdztRxmVSzsswBxZfjMZtnE0BLOSJ3qCftHp7X7u6J4lNeIJCNHF1P4A1GqwzSCOF/LTqf91sK2WWKOb/FmopKhW2LC/xK3I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=Rks0BrJW; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="Rks0BrJW" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-36931e4f5e8so1553581a91.2 for ; Thu, 14 May 2026 23:56:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1778828174; x=1779432974; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=VL9MOgE8V1tj2rmnSqeusE5lJRxKq56SKAjQcQI/xkI=; b=Rks0BrJWQNItbUBp+MfDgooPyfVxpaIk+ValZHzqmbRe3eRDj4zmjLdUap80tuk+Ac s3QHlUCSop2z7sZc3SNvgzOAP8mTXf77xWXgFwxTzRSL3iXyc+TVAD3USFHPIkRbY1fA Cnuar53LNKuEiV1eGUXITktGCs4zGO6y82gk4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778828174; x=1779432974; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=VL9MOgE8V1tj2rmnSqeusE5lJRxKq56SKAjQcQI/xkI=; b=rD+PAwWj5O5C4yd+m9l7j4bZnHJ0dxzcTnGLkk41ai4BQRaMGQR/pnbfUwiL4zFIV9 B4H7wMVbc1719oRJsFNcEOzb0K1N4nbZAzEbLa7JT/QxzVWZ591DoS95MncCh3yRFPdu 68Uxxydn9tptdOdnRcN6yIsgq2bW+xsvXgLQekSM/GwDeXECyaYof8pIDQfYXh2/W62q QCJoS8IoV7a818HnTwoJjkUD+u3QbV7MqRjggYaykEbKGn80Mb+xCuBPgE2v+T57Q0Rx sgKD79awOS9WPGszOCY5JyYpr2iDDopzQxY7O3IA/9xdxkc21wzn9KqPMe8Y7YSVooJo cj/Q== X-Forwarded-Encrypted: i=1; AFNElJ+4dOvBl2ZfPWvnj95LocgVlc9tCBYt+HqjwY2kUDoDlFpm8Dl/q7iKvpILVIXyW5KJ1WQR8600ZlnIggY=@vger.kernel.org X-Gm-Message-State: AOJu0YwUwYj/wEj7nvRu7q+0AK/kUK+XHgf/enFyu+C2XYZLezSMBKI0 H0mopqx7q2iEypsFv9c92B33LVyNHO8XoMHR9y/ZAQi+oO7qQhlQ2xdE3exPX0fOTt3ddqUEoJd VvA3iQuQJapU= X-Gm-Gg: Acq92OFAKyDh60qGUQOnv8kZePbUNZRSibr6X/eP6En70pxUGE9athWmQIeVkWYi+48 9cxUIgHWwVn9Ms/WRXKAd51tOhddFMuXK+lOnqoCaNcPedjgCMmquN6OdTLlZ6bTpwoKEt7SAko OeE2I+JtOeFNIstWZIKItcV+u9LkWty0vYa7MLj72hfMP2uC4cY02G5NcTuePM6lPZIMqV52qAm XUureG24cZmeNvmdvwHGTC/D6EFDkJVlbD3cLTPtdsYafLGZRABTCTNIQGTV0XhO5GnV0vGZJ1x NsboSoj5fNPs/+HoZN3sua8cDiMxxGAkuKewCm32B6Habeh7tMnBhySqSIt3otu77KZvLgsBJf4 qCjg67ZC46b6zVy8uzqXKmi92v911+i3QWb50DdArZF5PCHtTXMMqzPvha70VbbTUDdsrjT6pFU 5gtatwijWQjMHxD29+s+tDbLuLu9YSI/mA19Eh7MegROWau9DxLapJo0FZGpXw6MTwMQYUvu32Z qEnyeFpUc8PxZpEKwpdG6Ak X-Received: by 2002:a17:90b:540d:b0:361:3224:2f65 with SMTP id 98e67ed59e1d1-369519af6d2mr2650718a91.3.1778828174112; Thu, 14 May 2026 23:56:14 -0700 (PDT) Received: from ranjankumar.c.googlers.com.com (220.185.124.34.bc.googleusercontent.com. [34.124.185.220]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-369513fe6f2sm1688068a91.0.2026.05.14.23.56.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 May 2026 23:56:13 -0700 (PDT) From: Ranjan Kumar To: dmitry.torokhov@gmail.com Cc: bleung@chromium.org, bentiss@kernel.org, linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Ranjan Kumar Subject: [PATCH v2] Input: elan_i2c - prevent division by zero on invalid device parameters Date: Fri, 15 May 2026 06:52:35 +0000 Message-ID: <20260515065235.1913403-1-kumarranja@chromium.org> X-Mailer: git-send-email 2.54.0.563.g4f69b47b94-goog In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device firmware or device tree provides invalid zero values for x_traces, y_traces, x_mm, or y_mm, it results in a fatal division-by-zero exception leading to a kernel panic during device probe. Add sanity checks to ensure these physical parameters are non-zero before performing the division. If invalid values are detected, log a warning and fall back to safe default values (1) to safely bypass the division. This prevents the kernel panic while allowing the probe to complete successfully. Completing the probe ensures the sysfs nodes are created, keeping the firmware update path intact so a recovery firmware can be flashed to the device. Fixes: 6696777c6506 ("Input: add driver for Elan I2C/SMbus touchpad") Fixes: e3a9a1290688 ("Input: elan_i2c - do not query the info if they are p= rovided") Signed-off-by: Ranjan Kumar --- Changes in v2: - Changed error handling from aborting probe with -EINVAL to logging a warning and falling back to default values (1). - Bypassing the division instead of aborting preserves the sysfs interface for firmware updates and keeps the pointer functional. drivers/input/mouse/elan_i2c_core.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan= _i2c_core.c index fee1796da3d0..32b2849ab36a 100644 --- a/drivers/input/mouse/elan_i2c_core.c +++ b/drivers/input/mouse/elan_i2c_core.c @@ -425,8 +425,17 @@ static int elan_query_device_parameters(struct elan_tp= _data *data) if (error) return error; } - data->width_x =3D data->max_x / x_traces; - data->width_y =3D data->max_y / y_traces; + + if (unlikely(x_traces =3D=3D 0 || y_traces =3D=3D 0)) { + dev_warn(&client->dev, + "invalid trace numbers: x=3D%u, y=3D%u\n", + x_traces, y_traces); + data->width_x =3D 1; + data->width_y =3D 1; + } else { + data->width_x =3D data->max_x / x_traces; + data->width_y =3D data->max_y / y_traces; + } =20 if (device_property_read_u32(&client->dev, "touchscreen-x-mm", &x_mm) || @@ -440,8 +449,16 @@ static int elan_query_device_parameters(struct elan_tp= _data *data) data->x_res =3D elan_convert_resolution(hw_x_res, data->pattern); data->y_res =3D elan_convert_resolution(hw_y_res, data->pattern); } else { - data->x_res =3D (data->max_x + 1) / x_mm; - data->y_res =3D (data->max_y + 1) / y_mm; + if (unlikely(x_mm =3D=3D 0 || y_mm =3D=3D 0)) { + dev_warn(&client->dev, + "invalid physical dimensions: x_mm=3D%u, y_mm=3D%u\n", + x_mm, y_mm); + data->x_res =3D 1; + data->y_res =3D 1; + } else { + data->x_res =3D (data->max_x + 1) / x_mm; + data->y_res =3D (data->max_y + 1) / y_mm; + } } =20 if (device_property_read_bool(&client->dev, "elan,clickpad")) --=20 2.54.0.563.g4f69b47b94-goog