diff options
author | Jussi Kivilinna <jussi.kivilinna@mbnet.fi> | 2009-05-07 20:14:21 -0400 |
---|---|---|
committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2009-05-07 22:04:16 -0400 |
commit | 9e68177ef93b2f34eee5a1e1707bceef4b9ba69c (patch) | |
tree | 737c3245af23ec8b4cb9a1e05062f30ca37e4cb3 /drivers/input/ff-memless.c | |
parent | d07a9cba6be5c0e947afc1014b5a62182a86f1f1 (diff) |
Input: ff-memless - fix signed to unsigned bit overflow
When userspace sets effect->u.rumble.strong_magnitude to 0x8001 or
larger, ml_combine_effects() would always return strong_magnitude
0xffff.
Problem is that 'gain' is passed in as signed integer. Multiplying
magnitude (__u16) with gain (int) causes magnitude read as signed and
results negative value (with magnitude > 0x8000). This signed integer
is then divided and value, still negative, converted to 32bit unsigned
integer. Finally checking combine overflow min(new+old, 0xffff) gives
out 0xffff.
Fix is to simply change 'gain' to unsigned int.
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Acked-by: Anssi Hannula <anssi.hannula@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Diffstat (limited to 'drivers/input/ff-memless.c')
-rw-r--r-- | drivers/input/ff-memless.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c index bc4e40f3ede7..2d1415e16834 100644 --- a/drivers/input/ff-memless.c +++ b/drivers/input/ff-memless.c | |||
@@ -226,7 +226,7 @@ static int get_compatible_type(struct ff_device *ff, int effect_type) | |||
226 | */ | 226 | */ |
227 | static void ml_combine_effects(struct ff_effect *effect, | 227 | static void ml_combine_effects(struct ff_effect *effect, |
228 | struct ml_effect_state *state, | 228 | struct ml_effect_state *state, |
229 | int gain) | 229 | unsigned int gain) |
230 | { | 230 | { |
231 | struct ff_effect *new = state->effect; | 231 | struct ff_effect *new = state->effect; |
232 | unsigned int strong, weak, i; | 232 | unsigned int strong, weak, i; |