diff options
| author | Alan Stern <stern@rowland.harvard.edu> | 2026-10-10 13:44:15 -0400 |
|---|---|---|
| committer | Benjamin Tissoires <bentiss@kernel.org> | 2026-10-16 11:47:03 +0200 |
| commit | 5fe63b415c636c7f4f6848a8e53bdd4bbf0c300d (patch) | |
| tree | 471f0c7d356b2162a51120b270f41c657ad797f4 /include/linux | |
| parent | 143b379a041e013e244b42805ca3b6e4c1555d51 (diff) | |
HID: core: Fix out-of-bounds left shift by 32 in s32ton()
Syzbot reported an out-of-bounds shift (32-bit integer shifted left by
32) in the s32ton() routine in the HID core. This routine converts a
signed 32-bit integer to a signed n-bit integer, and it caps the value
of n at 32. But when n == 32 there's no need to do anything; it can
simply return the input value. This will avoid calculating (1 << n)
when n is 32, which was the cause of the invalid shift.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 69c02ffde6ed ("HID: core: clamp report_size in s32ton() to avoid undefined shift")
Reported-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/6ac9cbd8.a150a118.27e199.0025.GAE@google.com/
Tested-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/dfa0aa1c-e55e-4316-8307-f72a07383634@rowland.harvard.edu
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions