diff options
| author | Nikita Zhandarovich <n.zhandarovich@fintech.ru> | 2023-04-17 19:01:48 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-06-09 11:30:13 +0300 |
| commit | 954bd5a44b091340cc0c1d6cba4a110e83ab9294 (patch) | |
| tree | 38031c111f354d9e5a3e6c20ec2f25b6289929a5 /drivers/hid | |
| parent | adac1c22f54bef359eedb4f14461dfa07533e8af (diff) | |
| download | linux-954bd5a44b091340cc0c1d6cba4a110e83ab9294.tar.xz | |
HID: wacom: avoid integer overflow in wacom_intuos_inout()
commit bd249b91977b768ea02bf84d04625d2690ad2b98 upstream.
If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
operations and integer promotions are done, high bits in
wacom->serial[idx] will be filled with 1s as well.
Avoid this, albeit unlikely, issue by specifying left operand's __u64
type for the right operand.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/wacom_wac.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index 37754a1f733b..1bfcc94c1d23 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -831,7 +831,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom) /* Enter report */ if ((data[1] & 0xfc) == 0xc0) { /* serial number of the tool */ - wacom->serial[idx] = ((data[3] & 0x0f) << 28) + + wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) + (data[4] << 20) + (data[5] << 12) + (data[6] << 4) + (data[7] >> 4); |