Re: [PATCH v2] Input: joydev - avoid an undefined shift in the legacy 0x read

[Dmitry Torokhov]

On Wed, Nov 04, 2026 at 11:07:08AM +0800, Guanglei Zhu wrote:
> The legacy 0.x read path shifts the axis values by the calibration
> constants that JS_SET_CAL installs:
> 
>         data.x = (joydev->abs[0] / 256 + 128) >> joydev->glue.JS_CORR.x;
>         data.y = (joydev->abs[1] / 256 + 128) >> joydev->glue.JS_CORR.y;
> 
> JS_CORR is copied straight from userspace as three s32 values and
> never validated, so the shift count can be negative or wider than
> the type, which is undefined behavior: the shift compiles to
> whatever the architecture does with an out-of-range count, and the
> compiler is free to assume it cannot happen.
> 
> Clamp the shift count to the width of the shifted value.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>

Applied, thank you.

-- 
Dmitry