summaryrefslogtreecommitdiff
path: root/drivers/hid
diff options
context:
space:
mode:
authorNikita Zhandarovich <n.zhandarovich@fintech.ru>2023-04-17 19:01:48 +0300
committerJiri Kosina <jkosina@suse.cz>2023-05-23 16:08:23 +0300
commitbd249b91977b768ea02bf84d04625d2690ad2b98 (patch)
treec06cdb219a85d56279c345d49d515192656b38c0 /drivers/hid
parentd9eef346b601afb0bd74b49e0db06f6a5cebd030 (diff)
downloadlinux-bd249b91977b768ea02bf84d04625d2690ad2b98.tar.xz
HID: wacom: avoid integer overflow in wacom_intuos_inout()
If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic operations and integer promotions are done, high bits in wacom->serial[idx] will be filled with 1s as well. Avoid this, albeit unlikely, issue by specifying left operand's __u64 type for the right operand. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization") Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/wacom_wac.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index dc0f7d9a992c..2ccf83837134 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -831,7 +831,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
/* Enter report */
if ((data[1] & 0xfc) == 0xc0) {
/* serial number of the tool */
- wacom->serial[idx] = ((data[3] & 0x0f) << 28) +
+ wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) +
(data[4] << 20) + (data[5] << 12) +
(data[6] << 4) + (data[7] >> 4);