diff mbox series

HID: wacom: avoid integer overflow in wacom_intuos_inout()

Message ID 20230417160148.60011-1-n.zhandarovich@fintech.ru
State New
Headers
Series HID: wacom: avoid integer overflow in wacom_intuos_inout() |

Commit Message

Nikita Zhandarovich April 17, 2023, 4:01 p.m. UTC 
  If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
operations and integer promotions are done, high bits in
wacom->serial[idx] will be filled with 1s as well.
Avoid this, albeit unlikely, issue by specifying left operand's __u64
type for the right operand.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
---
 drivers/hid/wacom_wac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Ping Cheng April 17, 2023, 5:13 p.m. UTC | #1 
On Mon, Apr 17, 2023 at 9:03 AM Nikita Zhandarovich
<n.zhandarovich@fintech.ru> wrote:
>
> If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
> operations and integer promotions are done, high bits in
> wacom->serial[idx] will be filled with 1s as well.
> Avoid this, albeit unlikely, issue by specifying left operand's __u64
> type for the right operand.

Thank you Nikita for the fix! It's good to avoid potential issues.

> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
>
> Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization")
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>

Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Cc: stable@vger.kernel.org

Cheers,
Ping
> ---
>  drivers/hid/wacom_wac.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
> index 9312d611db8e..0e4404f3801e 100644
> --- a/drivers/hid/wacom_wac.c
> +++ b/drivers/hid/wacom_wac.c
> @@ -826,7 +826,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
>         /* Enter report */
>         if ((data[1] & 0xfc) == 0xc0) {
>                 /* serial number of the tool */
> -               wacom->serial[idx] = ((data[3] & 0x0f) << 28) +
> +               wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) +
>                         (data[4] << 20) + (data[5] << 12) +
>                         (data[6] << 4) + (data[7] >> 4);
>
> --
> 2.25.1
>
Jiri Kosina May 23, 2023, 1:08 p.m. UTC | #2 
On Mon, 17 Apr 2023, Nikita Zhandarovich wrote:

> If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
> operations and integer promotions are done, high bits in
> wacom->serial[idx] will be filled with 1s as well.
> Avoid this, albeit unlikely, issue by specifying left operand's __u64
> type for the right operand.
> 
> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
> 
> Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization")
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>

Applied. Thanks for the fix, and sorry for the delay.
diff mbox series

Patch

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 9312d611db8e..0e4404f3801e 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -826,7 +826,7 @@  static int wacom_intuos_inout(struct wacom_wac *wacom)
 	/* Enter report */
 	if ((data[1] & 0xfc) == 0xc0) {
 		/* serial number of the tool */
-		wacom->serial[idx] = ((data[3] & 0x0f) << 28) +
+		wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) +
 			(data[4] << 20) + (data[5] << 12) +
 			(data[6] << 4) + (data[7] >> 4);