[PATCH v3] Input: joydev - avoid signed overflow in the broken-axis correction

[Guanglei Zhu <zhugl3@xiaopeng.com>]

The JS_CORR_BROKEN correction multiplies two 32-bit values taken
from user space via JSIOCSCORR before shifting and clamping:

	value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
			((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
			((corr->coef[2] * (value - corr->coef[0])) >> 14);

Nothing bounds the coefficients, so with large enough values the
products wrap around and the correction returns bogus axis values
for the rest of the session.

Compute the correction in 64 bits and clamp once, and flatten the
nested ternary so the dead zone returns 0 directly.

Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
---
v3: rework per review - pre-convert value to s64 and use if/else
    instead of the nested ternary with explicit casts, return 0
    directly from the dead zone, and clamp once instead of passing
    the value through the trailing clamp a second time; drop Fixes
    and the stable backport request since the kernel is built with
    -fno-strict-overflow and this only affects synthetic
    coefficients passed via JSIOCSCORR.

 drivers/input/joydev.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 32459fd..fbc6e77 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -67,22 +67,27 @@ struct joydev_client {
 
 static int joydev_correct(int value, struct js_corr *corr)
 {
+	s64 v64;
+
 	switch (corr->type) {
 
 	case JS_CORR_NONE:
-		break;
+		return clamp(value, -32767, 32767);
 
 	case JS_CORR_BROKEN:
-		value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
-			((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
-			((corr->coef[2] * (value - corr->coef[0])) >> 14);
-		break;
+		v64 = value;
+		if (value < corr->coef[0])
+			v64 = (v64 - corr->coef[0]) * corr->coef[2];
+		else if (value > corr->coef[0] && value > corr->coef[1])
+			v64 = (v64 - corr->coef[1]) * corr->coef[3];
+		else
+			return 0;
+
+		return clamp_val(v64 >> 14, -32767, 32767);
 
 	default:
 		return 0;
 	}
-
-	return clamp(value, -32767, 32767);
 }
 
 static void joydev_pass_event(struct joydev_client *client,
-- 
2.43.0