Re: [syzbot] [input?] [usb?] UBSAN: shift-out-of-bounds in s32ton
From: syzbot
Date: Wed Nov 13 2024 - 21:20:27 EST
> s32ton always be 0 when n>=32,add check n.
>
> #syz test
This crash does not have a reproducer. I cannot test it.
>
> diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> index 81d6c734c8bc..ead1d338fa58 100644
> --- a/drivers/hid/hid-core.c
> +++ b/drivers/hid/hid-core.c
> @@ -66,8 +66,11 @@ static s32 snto32(__u32 value, unsigned int n)
>
> static u32 s32ton(__s32 value, unsigned int n)
> {
> - s32 a = value >> (n - 1);
> + s32 a;
>
> + if (n >= 32)
> + return value;
> + a = value >> (n - 1);
> if (a && a != -1)
> return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
> return value & ((1 << n) - 1);