[PATCH] iio: inkern: Avoid risky abs() usage in iio_multiply_value()
From: Romain Gantois
Date: Tue Mar 31 2026 - 05:00:07 EST
iio_multiply_value() passes integers val and val2 directly to abs(). This
is problematic because if a signed argument to abs is the lowest value for
its type, then the result is undefined due to overflow.
Cast val and val2 to s64 before passing them to abs() to avoid this issue.
Fixes: 0f85406bf830 ("iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Romain Gantois <romain.gantois@xxxxxxxxxxx>
---
drivers/iio/inkern.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index 0df0ab3de2709..59e8c01457f72 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -618,8 +618,8 @@ int iio_multiply_value(int *result, s64 multiplier,
denominator = NANO;
break;
}
- *result = multiplier * abs(val);
- *result += div_s64(multiplier * abs(val2), denominator);
+ *result = multiplier * abs((s64)val);
+ *result += div_s64(multiplier * abs((s64)val2), denominator);
if (val < 0 || val2 < 0)
*result *= -1;
return IIO_VAL_INT;
---
base-commit: 6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f
change-id: 20260331-iio-multiply-abs-usage-2762180a8b0c
Best regards,
--
Romain Gantois <romain.gantois@xxxxxxxxxxx>