From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=71.18.227.2 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793184924; b=SG3NSfxwXLOGg5gBm3vtkRQYihWjfTx38TA/CaTioirKfnFcY9lOaHhXDpTAEgMMKN4D 6oZp/v1pi2ta3BBWLFWeXdOLeqIIU6FeNOj/UKvRsKHEM9oX8fEnayXaKUYktQ4OLMKuh 0+DQN3gKJRi/VoOBga0JtSgPZNXStpkWX77U6dak1sYUk6oR8cdZqKUsEMx4PY5Q/jrBx VAvpdHycKSrLzNV6xw7MpeuomeXXklyr8jq62n9olOaBKLsZzDnLNRgwuivYzq6uf6Tzn O29FURZhQRn3nJV98dorwXA1onOzRCc3z57JNmKOLQGbPQMjX6xgvambEZRiN8joi4w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793184924; h=DMARC-Filter:DKIM-Signature:Content-Type:Content-Transfer-Encoding: X-Change-Id:X-Original-From:Received:X-Lms-Return-Path:To:From: Subject:X-Mailer:X-B4-Tracking:Cc:Date:Message-Id:Mime-Version; bh=xk/LGmqAVOIr9rJ8TkRSY178UNjfbyNnpVZUhnBPxj8=; b=rFBSyy33/WXhP6bpnbrmTrPeMTNiXXd3BAUv5c1nKBxerjxscLEcfcKaBygZzeSqRwrj RxA9baTRPTrmKnSGXrA+zhEOJfxtPuRh0qBrDs9/p8jdl9zOEg3H3fHIwwlKD6W/m/R+5 qFpHqmSUAcLNDtte0hmNlCAdlXz2CM1H5q/24A2zHMDzydWgxS8Ux7dGNFUDtBZBUZ3R5 6EJhzGyPtNKUuOlSXXolHEP4v1RqL+bo+lxtZ2H6D8VIJkA19OjMlNDiI8EvehqIqC3ev ekZ2sz3I2kmBjztmaIEcINbf9Y6iVmy09giGbWxQyyVa0TkTgCWbhUwpYN0X/6/GCXg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass header.d=cherr.cc header.i=@cherr.cc header.a=rsa-sha256 header.s=feishu2604220257 header.b=y33nZB4j; arc=none smtp.remote-ip=71.18.227.2 Received: from sg-2-2.ptr.blmpb.com (sg-2-2.ptr.blmpb.com [71.18.227.2]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E37C606A31D for ; Wed, 28 Oct 2026 10:55:22 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 1E37C606A31D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=cherr.cc header.i=@cherr.cc header.a=rsa-sha256 header.s=feishu2604220257 header.b=y33nZB4j DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1793184912; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=xk/LGmqAVOIr9rJ8TkRSY178UNjfbyNnpVZUhnBPxj8=; b=y33nZB4j75a1Z+47KFsLP3yOAEcqAul7Q7z6QXbzm7npLLDNd0mBzD6cqnoAvECSmCUCh9 mwkf5j9dBZuX1zbRFGYly/iTvG1uble6BdniNBwM+rYYPzSfU1MYzFeGx6sjtyc7yTJVjc pghjk3JsKEI4yrWSEM6RYB1sOANGswe+7kzB+0exhOayc3aPVA5AIF1A4KBnvkPksKDczP pCxqgLvGHEdjABp+w62KoZ9HHqjTGpxinOZSY0p6e49bc4qGSRKLlzsJqJnUiOR6DzEdiB juMTf49GpXeF3Cf/Vq/K1VdyQAAjcINhjxIMAlb65oZejusKLr/XG9KJ17g7qg== Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Change-Id: 20261028-b4-pidff-duration-shift-8df4f6451448 X-Original-From: Shengzhuo Wei Received: from [127.0.1.1] ([111.42.148.12]) by smtp.feishu.cn with ESMTPS; Wed, 28 Oct 2026 18:55:09 +0800 X-Lms-Return-Path: To: =?utf-8?q?Tomasz_Paku=C5=82a?= , "Oleg Makarenko" , "Jiri Kosina" , "Benjamin Tissoires" From: "Shengzhuo Wei" Subject: [PATCH] HID: pidff: fix undefined shift for infinite duration X-Mailer: b4 0.16.0 X-B4-Tracking: v=1; b=H4sIAIXU4WoC/yXMQQqDQAyF4atI1g04QyqDVyldqJNoXFiZjKUg3 t2xLj9479/BOCkbtNUOib9q+lkK3KOCYeqWkVFjMfjaN672AXvCVaMIxi11uazRJpWMIQpJQ09 HFKC818Siv3/59b5tWz/zkK8cHMcJBidogHsAAAA= Cc: , , , , "Shengzhuo Wei" Date: Wed, 28 Oct 2026 18:55:02 +0800 Message-Id: <20261028-b4-pidff-duration-shift-v1-1-65028c6b4a37@cherr.cc> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 pidff_set_duration() computes the infinite duration as (1U << report_size) - 1, but report_size comes from the device's report descriptor and can be 32 or greater. This causes an undefined shift. A UHID test on x86-64 triggers UBSAN and programs a 32-bit duration field as zero instead of 0xffffffff. For report sizes of 32 or more, store -1 in the s32 field value to set all 32 bits without shifting. Keep the existing calculation for smaller fields. Fixes: 1a575044d516 ("HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff") Cc: stable@vger.kernel.org Signed-off-by: Shengzhuo Wei --- HID: pidff: fix undefined shift for infinite duration --- drivers/hid/usbhid/hid-pidff.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c index 22951b7ecd17..25b82e7d0b9e 100644 --- a/drivers/hid/usbhid/hid-pidff.c +++ b/drivers/hid/usbhid/hid-pidff.c @@ -394,7 +394,11 @@ static void pidff_set_duration(struct pidff_usage *usage, u16 duration) { /* PID defines INFINITE as the max possible value for duration field */ if (pidff_is_duration_infinite(duration)) { - usage->value[0] = (1U << usage->field->report_size) - 1; + if (usage->field->report_size >= 32) + usage->value[0] = -1; + else + usage->value[0] = + (1U << usage->field->report_size) - 1; return; } --- base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e change-id: 20261028-b4-pidff-duration-shift-8df4f6451448 Best regards, -- Shengzhuo Wei