[PATCH] HID: pidff: fix undefined shift for infinite duration

[PATCH] HID: pidff: fix undefined shift for infinite duration

[Shengzhuo Wei]

pidff_set_duration() computes the infinite duration as
(1U << report_size) - 1, but report_size comes from the device's
report descriptor and can be 32 or greater. This causes an undefined
shift. A UHID test on x86-64 triggers UBSAN and programs a 32-bit
duration field as zero instead of 0xffffffff.

For report sizes of 32 or more, store -1 in the s32 field value to
set all 32 bits without shifting. Keep the existing calculation for
smaller fields.

Fixes: 1a575044d516 ("HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
HID: pidff: fix undefined shift for infinite duration
---
 drivers/hid/usbhid/hid-pidff.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
index 22951b7ecd17..25b82e7d0b9e 100644
--- a/drivers/hid/usbhid/hid-pidff.c
+++ b/drivers/hid/usbhid/hid-pidff.c
@@ -394,7 +394,11 @@ static void pidff_set_duration(struct pidff_usage *usage, u16 duration)
 {
 	/* PID defines INFINITE as the max possible value for duration field */
 	if (pidff_is_duration_infinite(duration)) {
-		usage->value[0] = (1U << usage->field->report_size) - 1;
+		if (usage->field->report_size >= 32)
+			usage->value[0] = -1;
+		else
+			usage->value[0] =
+				(1U << usage->field->report_size) - 1;
 		return;
 	}
 

---
base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
change-id: 20261028-b4-pidff-duration-shift-8df4f6451448

Best regards,
--  
Shengzhuo Wei <me@cherr.cc>

Re: [PATCH] HID: pidff: fix undefined shift for infinite duration

[Tomasz Pakuła]

On Wed, 2026-10-28 at 18:55 +0800, Shengzhuo Wei wrote:
> pidff_set_duration() computes the infinite duration as
> (1U << report_size) - 1, but report_size comes from the device's
> report descriptor and can be 32 or greater. This causes an undefined
> shift. A UHID test on x86-64 triggers UBSAN and programs a 32-bit
> duration field as zero instead of 0xffffffff.
> 
> For report sizes of 32 or more, store -1 in the s32 field value to
> set all 32 bits without shifting. Keep the existing calculation for
> smaller fields.

Yeah, that's a good idea even though finding a real device that would
trigger this would be quite difficult.

> 
> Fixes: 1a575044d516 ("HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shengzhuo Wei <me@cherr.cc>
> ---
> HID: pidff: fix undefined shift for infinite duration
> ---
>  drivers/hid/usbhid/hid-pidff.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
> index 22951b7ecd17..25b82e7d0b9e 100644
> --- a/drivers/hid/usbhid/hid-pidff.c
> +++ b/drivers/hid/usbhid/hid-pidff.c
> @@ -394,7 +394,11 @@ static void pidff_set_duration(struct pidff_usage *usage, u16 duration)
>  {
>  	/* PID defines INFINITE as the max possible value for duration field */
>  	if (pidff_is_duration_infinite(duration)) {
> -		usage->value[0] = (1U << usage->field->report_size) - 1;
> +		if (usage->field->report_size >= 32)
> +			usage->value[0] = -1;
> +		else
> +			usage->value[0] =
> +				(1U << usage->field->report_size) - 1;

I prefer default operations instead of if/else. Just a style preference.
Would you mind changing this to unguarded
`usage->value[0] = -1;`
and then the previous calculation behind
`if (usage->field->report_size < 32)` ?

>  		return;
>  	}
>  
> 
> ---
> base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
> change-id: 20261028-b4-pidff-duration-shift-8df4f6451448
> 
> Best regards,
> --  
> Shengzhuo Wei <me@cherr.cc>