From: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Date: Fri, 8 May 2009 00:14:21 +0000 (-0700)
Subject: Input: ff-memless - fix signed to unsigned bit overflow
X-Git-Tag: linux-omap-v2.6.30-rc6~35^2~2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9e68177ef93b2f34eee5a1e1707bceef4b9ba69c;p=pandora-kernel.git

Input: ff-memless - fix signed to unsigned bit overflow

When userspace sets effect->u.rumble.strong_magnitude to 0x8001 or
larger, ml_combine_effects() would always return strong_magnitude
0xffff.

Problem is that 'gain' is passed in as signed integer. Multiplying
magnitude (__u16) with gain (int) causes magnitude read as signed and
results negative value (with magnitude > 0x8000). This signed integer
is then divided and value, still negative, converted to 32bit unsigned
integer. Finally checking combine overflow min(new+old, 0xffff) gives
out 0xffff.

Fix is to simply change 'gain' to unsigned int.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Acked-by: Anssi Hannula <anssi.hannula@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
---

Reading git-diff-tree failed