linux-kernel - Re: [PATCH] HID: wacom: avoid integer overflow in wacom_intuos

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 23 May 2023 15:08:44 +0200 (CEST)
From:   Jiri Kosina <jikos@...nel.org>
To:     Nikita Zhandarovich <n.zhandarovich@...tech.ru>
cc:     Ping Cheng <ping.cheng@...om.com>,
        Jason Gerecke <jason.gerecke@...om.com>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
        lvc-project@...uxtesting.org
Subject: Re: [PATCH] HID: wacom: avoid integer overflow in
 wacom_intuos_inout()

On Mon, 17 Apr 2023, Nikita Zhandarovich wrote:

> If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
> operations and integer promotions are done, high bits in
> wacom->serial[idx] will be filled with 1s as well.
> Avoid this, albeit unlikely, issue by specifying left operand's __u64
> type for the right operand.
> 
> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
> 
> Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization")
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>

Applied. Thanks for the fix, and sorry for the delay.

-- 
Jiri Kosina
SUSE Labs