Skip to content

Commit

Permalink
HID: nintendo: Prevent divide-by-zero on code
Browse files Browse the repository at this point in the history
It was reported [0] that adding a generic joycon to the system caused
a kernel crash on Steam Deck, with the below panic spew:

divide error: 0000 [linuxppc#1] PREEMPT SMP NOPTI
[...]
Hardware name: Valve Jupiter/Jupiter, BIOS F7A0119 10/24/2023
RIP: 0010:nintendo_hid_event+0x340/0xcc1 [hid_nintendo]
[...]
Call Trace:
 [...]
 ? exc_divide_error+0x38/0x50
 ? nintendo_hid_event+0x340/0xcc1 [hid_nintendo]
 ? asm_exc_divide_error+0x1a/0x20
 ? nintendo_hid_event+0x307/0xcc1 [hid_nintendo]
 hid_input_report+0x143/0x160
 hidp_session_run+0x1ce/0x700 [hidp]

Since it's a divide-by-0 error, by tracking the code for potential
denominator issues, we've spotted 2 places in which this could happen;
so let's guard against the possibility and log in the kernel if the
condition happens. This is specially useful since some data that
fills some denominators are read from the joycon HW in some cases,
increasing the potential for flaws.

[0] ValveSoftware/SteamOS#1070

Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Tested-by: Sam Lantinga <slouken@libsdl.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
  • Loading branch information
guilhermepiccoli authored and rohanmclure committed Feb 5, 2024
1 parent fcc95b8 commit d3ed36c
Showing 1 changed file with 20 additions and 7 deletions.
27 changes: 20 additions & 7 deletions drivers/hid/hid-nintendo.c
Original file line number Diff line number Diff line change
Expand Up @@ -927,14 +927,27 @@ static int joycon_request_calibration(struct joycon_ctlr *ctlr)
*/
static void joycon_calc_imu_cal_divisors(struct joycon_ctlr *ctlr)
{
int i;
int i, divz = 0;

for (i = 0; i < 3; i++) {
ctlr->imu_cal_accel_divisor[i] = ctlr->accel_cal.scale[i] -
ctlr->accel_cal.offset[i];
ctlr->imu_cal_gyro_divisor[i] = ctlr->gyro_cal.scale[i] -
ctlr->gyro_cal.offset[i];

if (ctlr->imu_cal_accel_divisor[i] == 0) {
ctlr->imu_cal_accel_divisor[i] = 1;
divz++;
}

if (ctlr->imu_cal_gyro_divisor[i] == 0) {
ctlr->imu_cal_gyro_divisor[i] = 1;
divz++;
}
}

if (divz)
hid_warn(ctlr->hdev, "inaccurate IMU divisors (%d)\n", divz);
}

static const s16 DFLT_ACCEL_OFFSET /*= 0*/;
Expand Down Expand Up @@ -1163,16 +1176,16 @@ static void joycon_parse_imu_report(struct joycon_ctlr *ctlr,
JC_IMU_SAMPLES_PER_DELTA_AVG) {
ctlr->imu_avg_delta_ms = ctlr->imu_delta_samples_sum /
ctlr->imu_delta_samples_count;
/* don't ever want divide by zero shenanigans */
if (ctlr->imu_avg_delta_ms == 0) {
ctlr->imu_avg_delta_ms = 1;
hid_warn(ctlr->hdev,
"calculated avg imu delta of 0\n");
}
ctlr->imu_delta_samples_count = 0;
ctlr->imu_delta_samples_sum = 0;
}

/* don't ever want divide by zero shenanigans */
if (ctlr->imu_avg_delta_ms == 0) {
ctlr->imu_avg_delta_ms = 1;
hid_warn(ctlr->hdev, "calculated avg imu delta of 0\n");
}

/* useful for debugging IMU sample rate */
hid_dbg(ctlr->hdev,
"imu_report: ms=%u last_ms=%u delta=%u avg_delta=%u\n",
Expand Down

0 comments on commit d3ed36c

Please sign in to comment.