From nobody Sat Jun 13 04:51:22 2026 Received: from mail-ej1-f41.google.com (mail-ej1-f41.google.com [209.85.218.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 418A33793BF for ; Sun, 10 May 2026 12:23:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778415838; cv=none; b=C+ilL8egIm7KtJmirJDNa3muy18dbXxNs98l9HJzZ2lxTz3aeAqu2nzj70ETML/t+aep1m3esTcV7eh/FUft952pd3JT3pAoXYodkRv4UiBhRfxPbuCy+j4jUh/HMvEqU0XBx9xwc5KGYKvYIRxm+C/Ip547pmawwKRUY2D1KRI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778415838; c=relaxed/simple; bh=hkAEcL6nfvQODU2P0IFadfabnehkvacnCGHyVpjrIGY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=ZNn1I+T/8b2sHLgIv51/c95hMjQbdMHEH/NKzzkgEbB5QYOlAjtA4YF7hM8xsIEm+wV5wbP8mfCd9VWCGTNq25mAB0q1ntjwbZI8mNRDZ27lRX0qZ9H1n8ntwBEfIFFpRGn6aSo85DpoIrGvXGvM2q9Gggm8MeYtrt5uTYe92Rc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=axlC8UC5; arc=none smtp.client-ip=209.85.218.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="axlC8UC5" Received: by mail-ej1-f41.google.com with SMTP id a640c23a62f3a-bcc859ac07fso20458466b.2 for ; Sun, 10 May 2026 05:23:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778415836; x=1779020636; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=8AtQVnnlrxzq6LC48B19jdYIcKO6FStZOhWhuwmTDN4=; b=axlC8UC5U1u6nE2hoPg9XQCWls8NeZw1vPQekRWilTfkqt4+LxddMkmEUYKWnG+hy0 y280iZ8BTY4Lal/TVSy0v+3cXbeeizmJBVvNJ8EZboYUt9KEGfZPkV6KvREwHsRX9J7A BglcvuwCuKyaVdrHs9zIDJ5pjwA3wRc1docp3BZlirdHNeSnoyvnGZx8uBFo1clz20xN jz7VU+eX7/7ISZ8jn8/AMiseMJvtTWh5dhvB1ngNhr70b/fb00ubDiHWSk3lgDxoh/yo nKGkPk6AS4+/32ULsPHTBUWoxXP3gLXj9cxfi7M7yUo2GCLy+fKn82MkA2qkUkBf1Rds lqdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778415836; x=1779020636; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=8AtQVnnlrxzq6LC48B19jdYIcKO6FStZOhWhuwmTDN4=; b=P9ojhc3maSWuCftYZDGo6LDLCj/+9ePaBqIWkzWargnv2fez+w86CDltm4I7LN2XJ9 ERrJ+HMxToXznAHdXdiWU0DSYRVKLwiaWSYm/978uMRaRBP9IfSOR+Qc1U3xoMpOSO30 wZ0KTDEV0OpeiwkWmV9qyi1k9so1y1NeksuWE/O5uNtY7+NWOg+1FtsiMsZnpLPdpbXJ 3ILxZDFDnSHsXEM/F4gWzSSSccp5INfaIoJjvjxQ/L4j1Xw8lQn6xnxV23wpKrPetlMs m9OHdgzldKF1Gt2evQnMhGBzlcVrNm2xAZxsEPl/+mKqvCr1XrGAwVcgwJUX8hUvmZN8 aR+Q== X-Forwarded-Encrypted: i=1; AFNElJ+vIrgwG4cDCnVULbfPi+WIt5he54nvcTvQ+tLJ9TIDuoqMbSFeFPh7Az7+bW/O0yVnf7rlmQadWwrMrZY=@vger.kernel.org X-Gm-Message-State: AOJu0YwjEX0x7BxbloS/X3qPNwi40gmueovuGoAnDpW1fgZacGoEhMaG W8taMfsu4UK+asNOCe+te4OCeueGbyWHsfel67q/O9pJKGRSj1TFadSe X-Gm-Gg: Acq92OFJtt+WTJzSr7F9ocG0I+zPdQl+UZscChd+ucXCM44oFWqxk1zQEUb/jZbQr49 Uvi2h7MqA7YAPAw6qB6vXbBoky905RmqAh9aOphpWEt6FsnWZipOOE62z2NKjyAZCafHEjmOgRJ viqb88Sxwv6eA20in1tBgE8WpRlAcpwbGJn+ejxxhs3/O8pWdRasolrwb/vfDqHRPqe15P4gL3T Mf42va0qvoxlOb8gGlVhpbDOz9LtI2EOyuA03W0WGQtNGw9gOGoZl1VuWLoF+6ZkdIavfSy0H1s O5+1RW0qtRyPflgNfK4J4i3mEMSz5Z0biM/Pgem6thrYHYPwDDSI+bhiMMjm+GJOvczONBOXF61 Nkxx8fPcwm1nZgRSmFSKquztDw48GecTHUMBuCjuJMqLIXT/MsKvA9Pk7W+HH2xjf1ztKRZrTaL jGEawLCGO/umgX8WIS4ToKMxMigNpKVh2UG90fu7nG009kgJsuxA403Vmk8vX8QF0USGzFhBjRR NnbLdlk+quqa/E= X-Received: by 2002:a17:907:3f1b:b0:bcc:9150:213d with SMTP id a640c23a62f3a-bcc91502b69mr101154166b.4.1778415835290; Sun, 10 May 2026 05:23:55 -0700 (PDT) Received: from laptok.lan (87-205-5-123.static.ip.netia.com.pl. [87.205.5.123]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-bcabd5cef81sm350990266b.0.2026.05.10.05.23.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 10 May 2026 05:23:55 -0700 (PDT) From: =?UTF-8?q?Tomasz=20Paku=C5=82a?= To: jikos@kernel.org, bentiss@kernel.org Cc: oleg@makarenk.ooo, linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, tomasz.pakula.oficjalny@gmail.com Subject: [PATCH v2] HID: pidff: Fix integer overflow in pidff_rescale Date: Sun, 10 May 2026 14:23:52 +0200 Message-ID: <20260510122352.1161826-1-tomasz.pakula.oficjalny@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Rescaling values close to the max (U16_MAX) temporarily creates values that exceed the s32 range. This caused value overflow in case when, for example, a periodic effect phase was higer than 180 degrees. In turn, rescale function could return values outised of the logical range of the HID field. Fix by using 64 bit signed integer to store the value during calculation but still return only 32 bit integer. Closes: https://github.com/JacKeTUs/universal-pidff/issues/116 Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices") Cc: Signed-off-by: Tomasz Paku=C5=82a --- For inclusion in 7.1 RC period. v2: use div_s64() instead of plain division drivers/hid/usbhid/hid-pidff.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c index aee8a4443305..c45f182d0448 100644 --- a/drivers/hid/usbhid/hid-pidff.c +++ b/drivers/hid/usbhid/hid-pidff.c @@ -11,6 +11,7 @@ #include "hid-pidff.h" #include #include +#include #include #include #include @@ -326,8 +327,10 @@ static s32 pidff_clamp(s32 i, struct hid_field *field) */ static int pidff_rescale(int i, int max, struct hid_field *field) { - return i * (field->logical_maximum - field->logical_minimum) / max + - field->logical_minimum; + /* 64 bits needed for big values during rescale */ + s64 result =3D field->logical_maximum - field->logical_minimum; + + return div_s64(result * i, max) + field->logical_minimum; } =20 /* --=20 2.54.0