From: Nikita Zhandarovich Date: Mon, 17 Apr 2023 16:01:48 +0000 (-0700) Subject: HID: wacom: avoid integer overflow in wacom_intuos_inout() X-Git-Tag: v6.1.37~587 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=3fb021f5c1144073398404bc47c7f4a282311d86;p=platform%2Fkernel%2Flinux-starfive.git HID: wacom: avoid integer overflow in wacom_intuos_inout() commit bd249b91977b768ea02bf84d04625d2690ad2b98 upstream. If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic operations and integer promotions are done, high bits in wacom->serial[idx] will be filled with 1s as well. Avoid this, albeit unlikely, issue by specifying left operand's __u64 type for the right operand. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization") Signed-off-by: Nikita Zhandarovich Reviewed-by: Ping Cheng Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index d2f5002..9c30dd3 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -826,7 +826,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom) /* Enter report */ if ((data[1] & 0xfc) == 0xc0) { /* serial number of the tool */ - wacom->serial[idx] = ((data[3] & 0x0f) << 28) + + wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) + (data[4] << 20) + (data[5] << 12) + (data[6] << 4) + (data[7] >> 4);