[PATCH] HID: core: Fix out-of-bounds left shift by 32 in s32ton()

[PATCH] HID: core: Fix out-of-bounds left shift by 32 in s32ton()

[Alan Stern]

Syzbot reported an out-of-bounds shift (32-bit integer shifted left by
32) in the s32ton() routine in the HID core.  This routine converts a
signed 32-bit integer to a signed n-bit integer, and it caps the value
of n at 32.  But when n == 32 there's no need to do anything; it can
simply return the input value.  This will avoid calculating (1 << n)
when n is 32, which was the cause of the invalid shift.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 69c02ffde6ed ("HID: core: clamp report_size in s32ton() to avoid undefined shift")
Reported-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/6ac9cbd8.a150a118.27e199.0025.GAE@google.com/
Tested-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org

---

 drivers/hid/hid-core.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Index: usb-devel/drivers/hid/hid-core.c
===================================================================
--- usb-devel.orig/drivers/hid/hid-core.c
+++ usb-devel/drivers/hid/hid-core.c
@@ -71,8 +71,8 @@ static u32 s32ton(__s32 value, unsigned
 	if (!value || !n)
 		return 0;
 
-	if (n > 32)
-		n = 32;
+	if (n >= 32)
+		return (u32) value;
 
 	a = value >> (n - 1);
 	if (a && a != -1)

Re: [PATCH] HID: core: Fix out-of-bounds left shift by 32 in s32ton()

[sashiko-bot]

> Syzbot reported an out-of-bounds shift (32-bit integer shifted left by
> 32) in the s32ton() routine in the HID core.  This routine converts a
> signed 32-bit integer to a signed n-bit integer, and it caps the value
> of n at 32.  But when n == 32 there's no need to do anything; it can
> simply return the input value.  This will avoid calculating (1 << n)
> when n is 32, which was the cause of the invalid shift.
> 
> Signed-off-by: Alan Stern <stern@rowland.harvard.edu>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/dfa0aa1c-e55e-4316-8307-f72a07383634@rowland.harvard.edu?part=1