OSDN Git Service

HID: wacom: avoid integer overflow in wacom_intuos_inout()
authorNikita Zhandarovich <n.zhandarovich@fintech.ru>
Mon, 17 Apr 2023 16:01:48 +0000 (09:01 -0700)
committerJiri Kosina <jkosina@suse.cz>
Tue, 23 May 2023 13:08:23 +0000 (15:08 +0200)
commitbd249b91977b768ea02bf84d04625d2690ad2b98
treec06cdb219a85d56279c345d49d515192656b38c0
parentd9eef346b601afb0bd74b49e0db06f6a5cebd030
HID: wacom: avoid integer overflow in wacom_intuos_inout()

If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
operations and integer promotions are done, high bits in
wacom->serial[idx] will be filled with 1s as well.
Avoid this, albeit unlikely, issue by specifying left operand's __u64
type for the right operand.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/wacom_wac.c