drivers/hid/wacom_wac.c | 32 ++++++++++++++++++++++++-------- drivers/hid/wacom_wac.h | 2 +- 2 files changed, 25 insertions(+), 9 deletions(-)
The dropped-packet calculation derives the sequence range in signed int
arithmetic. A sequence field whose logical range spans all 32-bit values
makes the range calculation wrap to zero, so the following modulo triggers
a divide exception.
Normalize the maximum and current value according to the HID parser's
signedness rule, and keep the sequence state and arithmetic in s64. This
also avoids overflowing value + 1 at the logical maximum.
Fixes: 359673ea3a20 ("HID: wacom: Support sequence numbers smaller than 16-bit")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
drivers/hid/wacom_wac.c | 32 ++++++++++++++++++++++++--------
drivers/hid/wacom_wac.h | 2 +-
2 files changed, 25 insertions(+), 9 deletions(-)
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index da1f0ea856..428ac7077a 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2527,18 +2527,34 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
case WACOM_HID_WD_BARRELSWITCH3:
wacom_wac->hid_data.barrelswitch3 = value;
return;
- case WACOM_HID_WD_SEQUENCENUMBER:
- if (wacom_wac->hid_data.sequence_number != value &&
+ case WACOM_HID_WD_SEQUENCENUMBER: {
+ s64 sequence_minimum = field->logical_minimum;
+ s64 sequence_maximum = sequence_minimum < 0 ?
+ (s64)field->logical_maximum :
+ (s64)(u32)field->logical_maximum;
+ s64 sequence_value = sequence_minimum < 0 ?
+ (s64)value : (s64)(u32)value;
+
+ if (wacom_wac->hid_data.sequence_number != sequence_value &&
wacom_wac->hid_data.sequence_number >= 0) {
- int sequence_size = field->logical_maximum - field->logical_minimum + 1;
- int drop_count = (value - wacom_wac->hid_data.sequence_number) % sequence_size;
- hid_warn(hdev, "Dropped %d packets", drop_count);
+ s64 sequence_size = sequence_maximum -
+ sequence_minimum + 1;
+ s64 drop_count = sequence_value -
+ wacom_wac->hid_data.sequence_number;
+
+ drop_count %= sequence_size;
+ if (drop_count < 0)
+ drop_count += sequence_size;
+ hid_warn(hdev, "Dropped %lld packets",
+ (long long)drop_count);
}
- wacom_wac->hid_data.sequence_number = value + 1;
- if (wacom_wac->hid_data.sequence_number > field->logical_maximum)
- wacom_wac->hid_data.sequence_number = field->logical_minimum;
+ if (sequence_value >= sequence_maximum)
+ wacom_wac->hid_data.sequence_number = sequence_minimum;
+ else
+ wacom_wac->hid_data.sequence_number = sequence_value + 1;
return;
}
+ }
/* send pen events only when touch is up or forced out
* or touch arbitration is off
diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
index 126bec6e5c..74e7c5a04a 100644
--- a/drivers/hid/wacom_wac.h
+++ b/drivers/hid/wacom_wac.h
@@ -324,7 +324,7 @@ struct hid_data {
int bat_connected;
int ps_connected;
bool pad_input_event_flag;
- int sequence_number;
+ s64 sequence_number;
ktime_t time_delayed;
};
--
2.43.0Hi Aldo, kernel test robot noticed the following build errors: [auto build test ERROR on hid/for-next] [also build test ERROR on linus/master v7.3-rc3] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Aldo-Ariel-Panzardo/HID-wacom-avoid-overflows-in-sequence-number-tracking/20260915-111621 base: https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next patch link: https://lore.kernel.org/r/20260915141621.3011011-1-qwe.aldo%40gmail.com patch subject: [PATCH v2] HID: wacom: avoid overflows in sequence number tracking config: hexagon-allmodconfig (https://download.01.org/0day-ci/archive/20260917/202609171246.TbpsuolV-lkp@intel.com/config) compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 148ee2b266b73a49f1f31d0bd17d4818b91bee9f) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260917/202609171246.TbpsuolV-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202609171246.TbpsuolV-lkp@intel.com/ All errors (new ones prefixed by >>, old ones prefixed by <<): >> ERROR: modpost: drivers/hid/wacom.ko: symbol '__hexagon_moddi3' undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
Hi Aldo, kernel test robot noticed the following build errors: [auto build test ERROR on hid/for-next] [also build test ERROR on linus/master v7.3-rc3 next-20260914] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Aldo-Ariel-Panzardo/HID-wacom-avoid-overflows-in-sequence-number-tracking/20260915-111621 base: https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next patch link: https://lore.kernel.org/r/20260915141621.3011011-1-qwe.aldo%40gmail.com patch subject: [PATCH v2] HID: wacom: avoid overflows in sequence number tracking config: arm-randconfig-1001-20260916 (https://download.01.org/0day-ci/archive/20260917/202609170218.u9lMtoL0-lkp@intel.com/config) compiler: arm-linux-gnueabi-gcc (GCC) 8.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260917/202609170218.u9lMtoL0-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202609170218.u9lMtoL0-lkp@intel.com/ All errors (new ones prefixed by >>, old ones prefixed by <<): >> ERROR: modpost: drivers/hid/wacom.ko: symbol '__aeabi_ldivmod' undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
© 2016 - 2026 Red Hat, Inc.