iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HID: wacom: avoid integer overflow in wacom_intuos_inout()

Browse Source 
commit bd249b9197 upstream.

If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
operations and integer promotions are done, high bits in
wacom->serial[idx] will be filled with 1s as well.
Avoid this, albeit unlikely, issue by specifying left operand's __u64
type for the right operand.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 3bea733ab2 ("USB: wacom tablet driver reorganization")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Nikita Zhandarovich
2023-04-17 09:01:48 -07:00
committed by Greg Kroah-Hartman
parent adac1c22f5
commit 954bd5a44b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/hid/wacom_wac.c
View File

@ -831,7 +831,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
/* Enter report */ /* Enter report */
if ((data[1] & 0xfc) == 0xc0) { if ((data[1] & 0xfc) == 0xc0) {
/* serial number of the tool */ /* serial number of the tool */
wacom->serial[idx] = ((data[3] & 0x0f) << 28) + wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) +
(data[4] << 20) + (data[5] << 12) + (data[4] << 20) + (data[5] << 12) +
(data[6] << 4) + (data[7] >> 4); (data[6] << 4) + (data[7] >> 4);