summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorJussi Kivilinna <jussi.kivilinna@mbnet.fi>2009-05-08 04:14:21 +0400
committerDmitry Torokhov <dmitry.torokhov@gmail.com>2009-05-08 06:04:16 +0400
commit9e68177ef93b2f34eee5a1e1707bceef4b9ba69c (patch)
tree737c3245af23ec8b4cb9a1e05062f30ca37e4cb3 /drivers
parentd07a9cba6be5c0e947afc1014b5a62182a86f1f1 (diff)
downloadlinux-9e68177ef93b2f34eee5a1e1707bceef4b9ba69c.tar.xz
Input: ff-memless - fix signed to unsigned bit overflow
When userspace sets effect->u.rumble.strong_magnitude to 0x8001 or larger, ml_combine_effects() would always return strong_magnitude 0xffff. Problem is that 'gain' is passed in as signed integer. Multiplying magnitude (__u16) with gain (int) causes magnitude read as signed and results negative value (with magnitude > 0x8000). This signed integer is then divided and value, still negative, converted to 32bit unsigned integer. Finally checking combine overflow min(new+old, 0xffff) gives out 0xffff. Fix is to simply change 'gain' to unsigned int. Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> Acked-by: Anssi Hannula <anssi.hannula@gmail.com> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/input/ff-memless.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c
index bc4e40f3ede7..2d1415e16834 100644
--- a/drivers/input/ff-memless.c
+++ b/drivers/input/ff-memless.c
@@ -226,7 +226,7 @@ static int get_compatible_type(struct ff_device *ff, int effect_type)
*/
static void ml_combine_effects(struct ff_effect *effect,
struct ml_effect_state *state,
- int gain)
+ unsigned int gain)
{
struct ff_effect *new = state->effect;
unsigned int strong, weak, i;