Linux Input/HID development
 help / color / mirror / Atom feed
From: "Tomasz Pakuła" <tomasz.pakula.oficjalny@gmail.com>
To: jikos@kernel.org, bentiss@kernel.org
Cc: oleg@makarenk.ooo, linux-input@vger.kernel.org,
	linux-kernel@vger.kernel.org, tomasz.pakula.oficjalny@gmail.com
Subject: [PATCH] HID: pidff: Fix integer overflow in pidff_rescale
Date: Tue, 21 Apr 2026 21:49:41 +0200	[thread overview]
Message-ID: <20260421194941.1422722-1-tomasz.pakula.oficjalny@gmail.com> (raw)

Rescaling values close to the max (U16_MAX) temporairly creates values
that exceed the s32 range. This caused value overflow in case when, for
example, a periodic effect phase was higher than 180 degrees. In turn,
rescale function could return values outside of the logical range of the
HID field (negative when logical minimum is 0).

Fix by using 64 bit signed integer to store the value during calculation
but still return only 32 bit integer.

Closes: https://github.com/JacKeTUs/universal-pidff/issues/116
Cc: <stable@vger.kernel.org>
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
---
For inclusion in the 7.1-RC period

 drivers/hid/usbhid/hid-pidff.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
index aee8a4443305..fb9b4f292732 100644
--- a/drivers/hid/usbhid/hid-pidff.c
+++ b/drivers/hid/usbhid/hid-pidff.c
@@ -326,8 +326,9 @@ static s32 pidff_clamp(s32 i, struct hid_field *field)
  */
 static int pidff_rescale(int i, int max, struct hid_field *field)
 {
-	return i * (field->logical_maximum - field->logical_minimum) / max +
-	       field->logical_minimum;
+	/* 64 bits needed for big values during rescale */
+	return (s64)i * (field->logical_maximum - field->logical_minimum) /
+		max + field->logical_minimum;
 }
 
 /*
-- 
2.53.0


             reply	other threads:[~2026-04-21 19:49 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-21 19:49 Tomasz Pakuła [this message]
2026-04-26  5:31 ` [PATCH] HID: pidff: Fix integer overflow in pidff_rescale kernel test robot
2026-04-26 10:48 ` Markus Elfring
2026-04-26 19:57   ` Tomasz Pakuła
2026-04-27  7:03     ` Markus Elfring
2026-04-26 12:35 ` [PATCH] " kernel test robot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260421194941.1422722-1-tomasz.pakula.oficjalny@gmail.com \
    --to=tomasz.pakula.oficjalny@gmail.com \
    --cc=bentiss@kernel.org \
    --cc=jikos@kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=oleg@makarenk.ooo \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox