[PATCH v2] Input: joydev - avoid signed overflow in the broken-axis correction

[Guanglei Zhu <zhugl3@xiaopeng.com>]

The JS_CORR_BROKEN correction multiplies two user-controlled 32-bit
values before shifting and clamping the result:

	value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
			((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
			((corr->coef[2] * (value - corr->coef[0])) >> 14);

The coefficients come from JSIOCSCORR without any range check, so
three things can go wrong: the subtractions can overflow 32 bits
(value = 0 against coef[1] = INT_MIN), the products can overflow the
type, and a product that survives the multiplication in 64 bits can
still wrap when the shifted result is assigned back to the int
variable, which then slips through clamp() as a small value instead
of saturating.

Compute the whole correction in 64 bits, including the subtractions,
and clamp with clamp_t(s64, ...) before narrowing, which is
bit-identical for every in-range input.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
---
v2: per review, extend the 64-bit computation to cover the subtractions
    ((s64)value - coef, which could overflow 32 bits before the
    promotion in v1) and keep the shifted product in s64 through
    clamp_t(s64, ...) so an out-of-range result saturates instead of
    wrapping during the narrowing to int.

 drivers/input/joydev.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 32459fd..18aa9ce 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -72,11 +72,15 @@ static int joydev_correct(int value, struct js_corr *corr)
 	case JS_CORR_NONE:
 		break;
 
-	case JS_CORR_BROKEN:
-		value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
-			((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
-			((corr->coef[2] * (value - corr->coef[0])) >> 14);
+	case JS_CORR_BROKEN: {
+		s64 tmp = value > corr->coef[0] ?
+			(value < corr->coef[1] ? 0 :
+			 (s64)corr->coef[3] * ((s64)value - corr->coef[1])) :
+			(s64)corr->coef[2] * ((s64)value - corr->coef[0]);
+
+		value = clamp_t(s64, tmp >> 14, -32767, 32767);
 		break;
+	}
 
 	default:
 		return 0;
-- 
2.43.0