From 5fe63b415c636c7f4f6848a8e53bdd4bbf0c300d Mon Sep 17 00:00:00 2001 From: Alan Stern Date: Sat, 10 Oct 2026 13:44:15 -0400 Subject: [PATCH] HID: core: Fix out-of-bounds left shift by 32 in s32ton() Syzbot reported an out-of-bounds shift (32-bit integer shifted left by 32) in the s32ton() routine in the HID core. This routine converts a signed 32-bit integer to a signed n-bit integer, and it caps the value of n at 32. But when n == 32 there's no need to do anything; it can simply return the input value. This will avoid calculating (1 << n) when n is 32, which was the cause of the invalid shift. Signed-off-by: Alan Stern Fixes: 69c02ffde6ed ("HID: core: clamp report_size in s32ton() to avoid undefined shift") Reported-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/6ac9cbd8.a150a118.27e199.0025.GAE@google.com/ Tested-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Link: https://patch.msgid.link/dfa0aa1c-e55e-4316-8307-f72a07383634@rowland.harvard.edu Signed-off-by: Benjamin Tissoires --- drivers/hid/hid-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index a3ff0514f9cd..a71ddaa810a0 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -71,8 +71,8 @@ static u32 s32ton(__s32 value, unsigned int n) if (!value || !n) return 0; - if (n > 32) - n = 32; + if (n >= 32) + return (u32) value; a = value >> (n - 1); if (a && a != -1)