Re: [PATCH 11/15] iio: hid-sensors: fix a division by zero

[Jonathan Cameron]

On Tue, 27 Oct 2026 17:19:15 +0100
Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:

> From: Josef Bacik <josef@xxxxxxxxxxxxxx>
> 
> convert_to_vtf_format() divides the micro part of a value by
> 10^(6 + exp).  The unit exponent of a HID field is a nibble and goes
> down to -8.  For -7 and -8 the argument of int_pow() is negative, which
> the unsigned parameter turns into a huge power of ten: 0 modulo 2^64.
> The division by it is a divide error.  The exponent comes from the report
> descriptor of the sensor hub, the value from a write to the hysteresis
> attribute of the IIO device.
> 
> Multiply by 10^(-exp - 6) in these two cases.
> 
> Fixes: 73c6768b710a ("iio: hid-sensors: Common attribute and trigger")
> Cc: stable <stable@xxxxxxxxxx>
> Cc: David Lechner <dlechner@xxxxxxxxxxxx>
> Cc: "Nuno Sá" <nuno.sa@xxxxxxxxxx>
> Cc: Andy Shevchenko <andy@xxxxxxxxxx>
> Cc: Sanjay Chitroda <sanjayembeddedse@xxxxxxxxx>
> Cc: Shi Hao <i.shihao.999@xxxxxxxxx>
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
+CC Jiri, and Srinivas given they are co-maintainers of this driver.


> ---
>  drivers/iio/common/hid-sensors/hid-sensor-attributes.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> index 9e7c26e37880..3b0985d500ae 100644
> --- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> +++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> @@ -140,7 +140,10 @@ static u32 convert_to_vtf_format(int size, int exp, int val1, int val2)
>  	if (val1 < 0 || val2 < 0)
>  		sign = -1;
>  	exp = hid_sensor_convert_exponent(exp);
> -	if (exp < 0) {
> +	if (exp < -6) {
> +		value = abs(val1) * int_pow(10, -exp);
> +		value += abs(val2) * int_pow(10, -exp - 6);
> +	} else if (exp < 0) {
>  		divisor = int_pow(10, 6 + exp);
>  		value = abs(val1) * int_pow(10, -exp);
>  		value += abs(val2) / divisor;
>