Re: [PATCH] iio: inkern: Avoid risky abs() usage in iio_multiply_value()

[Andy Shevchenko]

On Tue, Mar 31, 2026 at 10:49:59AM +0200, Romain Gantois wrote:
> iio_multiply_value() passes integers val and val2 directly to abs(). This
> is problematic because if a signed argument to abs is the lowest value for
> its type, then the result is undefined due to overflow.
> 
> Cast val and val2 to s64 before passing them to abs() to avoid this issue.

...

> Fixes: 0f85406bf830 ("iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()")

Doesn't fix any know issue for now.

...

> -		*result = multiplier * abs(val);
> -		*result += div_s64(multiplier * abs(val2), denominator);
> +		*result = multiplier * abs((s64)val);
> +		*result += div_s64(multiplier * abs((s64)val2), denominator);

Right, but here we get val and val2 from either static values from the driver
(when it is SCALE channel), or when channel has PROCESSED support.
In the latter one it might theoretically be possible to go till the INT_MIN,
but practically I don't know how, except for the broken driver code in the
first place. With that being said, I think it's better to validate somewhere
the multipliers (when it's SCALE or PROCESSED channel). I also noted that
for the _PROCESSED some drivers keep a garbage in val2. That probably needs
to be addressed as well (exempli gratia: bmi270_read_raw() does that).

-- 
With Best Regards,
Andy Shevchenko