From nobody Mon May 25 05:54:38 2026 Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6EAF73DEAC8 for ; Mon, 18 May 2026 06:28:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779085690; cv=none; b=B/3hETvHgQ5ZuDWzVTLwBSAIgFcId+CE00JrNpBEBzwfqNHGWEF580yZad7TxLSHHtqhGYE0J9w6MaUUNjf6T/bPXVzlkKElQCuReFcEgk7v+gsaQcuXf3aM4A2G3hJYrEBK4rH0r5wWwzbzLfeTUhvsKogIBWZuXHlpA0MmeqY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779085690; c=relaxed/simple; bh=PF+n4KOP9NgWo/xGyeMKj/3893fM/5sKdK+hvMSSslg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eOhnat+Qm2U8rpfm4mcp5LEJyyMC9TkkSHxtcTcqFyf1T090IkfBS/i5CK/Y+00HxTtRlti+WKdAgWI9KAmoyzWDkLYzXUUqIK77zlBQBDWq/JvhPvEBFjzvnxI5+n4yGCB2Za3KMq3R7IWP2qOjSpeqiOcKPm5ycm9U7ewb8Ak= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=PD693mCU; arc=none smtp.client-ip=209.85.215.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="PD693mCU" Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-c801b30188dso767947a12.3 for ; Sun, 17 May 2026 23:28:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1779085686; x=1779690486; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=IUdS91k6DCIDDf+xxGRcNX7yYkxmhqfcOdKFFb6YxKY=; b=PD693mCU6eeeekDE6eV4y682dwMt476wKNjgDycsZDnWM+5mANQbiCZbJPPUDOKHSO bHqIApZovBwxLXzCHsB5Jvavn5fW9YZle1FogFnBI/ENs8AOcq+hvmKi9r79p7U/GxRm +L1/kQnp5dsaBrrO6Kj/GxWfwZ4lYCgBlXz88= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779085686; x=1779690486; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=IUdS91k6DCIDDf+xxGRcNX7yYkxmhqfcOdKFFb6YxKY=; b=TeQKS4uhylA11Qe/2NHW5s7euiOjNdpULqgFEATZkv0mFJsR//7kEs+WjFSIUTBHHR +1EVuCFKDD765Oy1OLA2RRcEZzb3ebmDijiYGKDoC5V9Po+svsAWUtzVzWc26s5cZjSs jj+thg1xr0eS98q0qI1NB77c7Ah19MsQk/ppZNXCX0bDGxO991jBJMUuYXlsMzpRzmOs QTciYJPjnZjO/STvEstCMFVOCDOWWVnNX6aKS5iRVGxRX3UUfELAAwBO41zE4lTymXEy tsQFj30f1ZMR9E4qdE4rujhl1LJtohB0RtnN7+cPtV4RAv7vwD9gmYY08EssvGCVTrZq fsEQ== X-Forwarded-Encrypted: i=1; AFNElJ8TA1K/tUJDsVWPzNcZPoh6xqEv2K4JHAb12UakOfxHu8aI4XTRzq8V+ynzZ4OWttlONDij7dHkEJBZr3Y=@vger.kernel.org X-Gm-Message-State: AOJu0Yw+ppaW7mM2aE2AW+9zKoLboxZEX6Lg1RqJdxGhc3II7RiejbHN p1aWpnHjuDF1h0CuvzCuRef47+mTE9IBAPKZV2F1UBG+OvNG2Dxp/IOn/uRN5Mk2Yw== X-Gm-Gg: Acq92OERVjoOBixPkfzVXgonfuUxaZjfv/yEWOLwUJsIOatSgHS8RBgTTrWAIa4znG3 ZQhrjHtEJwNl3adRc0y0i1EunWT58wiDE4HrbHv9m9J2xPDVqhowwiEj5HLOutPCiIxR0wwd/Sq 9sbi5GhnCl3ASjHLSe/WEGNkFPFExzzeBKgcOOgT6WnENyVbsnqDsv3cRRzluJb1igg9N17Pyb0 RP3uCyzOn2nU74NAdE4k5m3/IbyDW182bHEGge+DImec8+vcGKFEd7xJAEVHiddf++H5Kd2aMwF JicDQtBl1cw42fIKV+1J0gU7Z8I5yXNd5gitoQaBlRlWuBhKwows8WZuR0ZKrNtPL4ZK/x5ApN2 X/Gbwfpq0onOdfW0TdogA7EkHy0ZpxW3nMRyM2/qd6CaWzcP7eZpqG1c2Hox0m6NRYdCqj4WUgr MvYu5B7MO/ECn3VicMBr7JGKYk+ySXVt+O4aDPFSPwupXzJnvI/SnHNecDLnzKpvQ4VORHN0jt1 BX67o2hVdVHNDJYJsAhw3zA X-Received: by 2002:a05:6a20:7fa3:b0:3af:91a:ff72 with SMTP id adf61e73a8af0-3b22ebd4615mr16180689637.34.1779085685907; Sun, 17 May 2026 23:28:05 -0700 (PDT) Received: from ranjankumar.c.googlers.com.com (220.185.124.34.bc.googleusercontent.com. [34.124.185.220]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c82bb062e56sm12525109a12.5.2026.05.17.23.28.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 17 May 2026 23:28:05 -0700 (PDT) From: Ranjan Kumar To: dmitry.torokhov@gmail.com Cc: bleung@chromium.org, bentiss@kernel.org, linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Ranjan Kumar Subject: [PATCH v3] Input: elan_i2c - prevent division by zero on invalid device parameters Date: Mon, 18 May 2026 06:26:24 +0000 Message-ID: <20260518062624.1147959-1-kumarranja@chromium.org> X-Mailer: git-send-email 2.54.0.563.g4f69b47b94-goog In-Reply-To: <20260515071052.7DDA0C2BCB0@smtp.kernel.org> References: <20260515071052.7DDA0C2BCB0@smtp.kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device firmware or device tree provides invalid zero values for x_traces, y_traces, x_mm, or y_mm, it results in a fatal division-by-zero exception leading to a kernel panic during device probe. Add sanity checks to ensure these physical parameters are non-zero before performing the division. If invalid trace values are detected, log a warning and fall back to ETP_FWIDTH_REDUCE to prevent arithmetic underflow during touch reporting. For invalid physical dimensions, fall back to a safe default of 1. This prevents the kernel panic while allowing the probe to complete successfully. Completing the probe ensures the sysfs nodes are created, keeping the firmware update path intact so a recovery firmware can be flashed to the device. Fixes: 6696777c6506 ("Input: add driver for Elan I2C/SMbus touchpad") Fixes: e3a9a1290688 ("Input: elan_i2c - do not query the info if they are p= rovided") Signed-off-by: Ranjan Kumar --- Changes in v3: - Changed trace fallback values from 1 to ETP_FWIDTH_REDUCE to prevent=20 an unsigned integer underflow in elan_report_absolute().=20 Changes in v2: - Changed error handling from aborting probe with -EINVAL to logging a warning and falling back to default values. drivers/input/mouse/elan_i2c_core.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan= _i2c_core.c index fee1796da3d0..c64e1dd1e60b 100644 --- a/drivers/input/mouse/elan_i2c_core.c +++ b/drivers/input/mouse/elan_i2c_core.c @@ -425,8 +425,17 @@ static int elan_query_device_parameters(struct elan_tp= _data *data) if (error) return error; } - data->width_x =3D data->max_x / x_traces; - data->width_y =3D data->max_y / y_traces; + + if (unlikely(x_traces =3D=3D 0 || y_traces =3D=3D 0)) { + dev_warn(&client->dev, + "invalid trace numbers: x=3D%u, y=3D%u\n", + x_traces, y_traces); + data->width_x =3D ETP_FWIDTH_REDUCE; + data->width_y =3D ETP_FWIDTH_REDUCE; + } else { + data->width_x =3D data->max_x / x_traces; + data->width_y =3D data->max_y / y_traces; + } =20 if (device_property_read_u32(&client->dev, "touchscreen-x-mm", &x_mm) || @@ -440,8 +449,16 @@ static int elan_query_device_parameters(struct elan_tp= _data *data) data->x_res =3D elan_convert_resolution(hw_x_res, data->pattern); data->y_res =3D elan_convert_resolution(hw_y_res, data->pattern); } else { - data->x_res =3D (data->max_x + 1) / x_mm; - data->y_res =3D (data->max_y + 1) / y_mm; + if (unlikely(x_mm =3D=3D 0 || y_mm =3D=3D 0)) { + dev_warn(&client->dev, + "invalid physical dimensions: x_mm=3D%u, y_mm=3D%u\n", + x_mm, y_mm); + data->x_res =3D 1; + data->y_res =3D 1; + } else { + data->x_res =3D (data->max_x + 1) / x_mm; + data->y_res =3D (data->max_y + 1) / y_mm; + } } =20 if (device_property_read_bool(&client->dev, "elan,clickpad")) --=20 2.54.0.563.g4f69b47b94-goog