Re: [PATCH v2] Input: joydev - avoid signed overflow in the broken-axis correction

[Dmitry Torokhov]

Hi Guanglei,

On Tue, Nov 03, 2026 at 04:55:14PM +0800, Guanglei Zhu wrote:
> The JS_CORR_BROKEN correction multiplies two user-controlled 32-bit
> values before shifting and clamping the result:
...
> -	case JS_CORR_BROKEN:
> -		value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
> -			((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
> -			((corr->coef[2] * (value - corr->coef[0])) >> 14);
> +	case JS_CORR_BROKEN: {
> +		s64 tmp = value > corr->coef[0] ?
> +			(value < corr->coef[1] ? 0 :
> +			 (s64)corr->coef[3] * ((s64)value - corr->coef[1])) :
> +			(s64)corr->coef[2] * ((s64)value - corr->coef[0]);
> +
> +		value = clamp_t(s64, tmp >> 14, -32767, 32767);
>  		break;
> +	}

Assigning to value and breaking out of the switch causes value to be
clamped a second time at the end of joydev_correct(). Also, pre-converting
value to s64 and replacing the nested ternary with if/else statements
avoids all the explicit (s64) casts and returns 0 immediately when the
input is in the deadzone:

static int joydev_correct(int value, struct js_corr *corr)
{
	s64 v64;

	switch (corr->type) {
	case JS_CORR_NONE:
		return clamp(value, -32767, 32767);

	case JS_CORR_BROKEN:
		v64 = value;
		if (value < corr->coef[0])
			v64 = (v64 - corr->coef[0]) * corr->coef[2];
		else if (value > corr->coef[0] && value > corr->coef[1])
			v64 = (v64 - corr->coef[1]) * corr->coef[3];
		else
			return 0;

		return clamp_val(v64 >> 14, -32767, 32767);

	default:
		return 0;
	}
}

Also, please note that the kernel builds with -fno-strict-overflow, so
signed overflow is defined as two's-complement wraparound rather than
compiler undefined behavior, and please drop Fixes and Cc: stable as
this only affects synthetic coefficients passed via JSIOCSCORR.

Thanks.

-- 
Dmitry