Re: [PATCH v3] Input: joydev - avoid signed overflow in the broken-axis correction

[Dmitry Torokhov]

On Wed, Nov 04, 2026 at 01:50:58PM +0800, Guanglei Zhu wrote:
> The JS_CORR_BROKEN correction multiplies two 32-bit values taken
> from user space via JSIOCSCORR before shifting and clamping:
> 
> 	value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
> 			((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
> 			((corr->coef[2] * (value - corr->coef[0])) >> 14);
> 
> Nothing bounds the coefficients, so with large enough values the
> products wrap around and the correction returns bogus axis values
> for the rest of the session.
> 
> Compute the correction in 64 bits and clamp once, and flatten the
> nested ternary so the dead zone returns 0 directly.
> 
> Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>

Applied, thank you.

-- 
Dmitry