Commit ca48bb17 authored by Nikita Zhandarovich's avatar Nikita Zhandarovich Committed by sanglipeng
Browse files

HID: wacom: avoid integer overflow in wacom_intuos_inout()

stable inclusion
from stable-v5.10.183
commit 954bd5a44b091340cc0c1d6cba4a110e83ab9294
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8IRR2

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=954bd5a44b091340cc0c1d6cba4a110e83ab9294



--------------------------------

commit bd249b91 upstream.

If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
operations and integer promotions are done, high bits in
wacom->serial[idx] will be filled with 1s as well.
Avoid this, albeit unlikely, issue by specifying left operand's __u64
type for the right operand.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 3bea733a ("USB: wacom tablet driver reorganization")
Signed-off-by: default avatarNikita Zhandarovich <n.zhandarovich@fintech.ru>
Reviewed-by: default avatarPing Cheng <ping.cheng@wacom.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent e6fe5707
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment