[PATCH] HID: wacom: validate battery range before scaling
From: Aldo Ariel Panzardo <hidden>
Date: 2026-09-15 04:12:59
Also in:
lkml, stable
Subsystem:
hid core layer, hid wacom driver, the rest · Maintainers:
Jiri Kosina, Benjamin Tissoires, Ping Cheng, Jason Gerecke, Linus Torvalds
Battery events divide by the difference between the logical maximum
and minimum without validating the range. A malformed HID descriptor
with equal limits can therefore trigger a divide-by-zero exception.
Move percentage conversion to a helper that widens the arithmetic,
rejects non-positive ranges and out-of-range results, and accounts for
a nonzero logical minimum.
Fixes: 37d160193834 ("HID: wacom: generic: Scale battery capacity measurements to percentages")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <redacted>
---
drivers/hid/wacom_wac.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index da1f0ea85..b93aac8e3 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c@@ -7,6 +7,7 @@ #include "wacom.h" #include <linux/input/mt.h> #include <linux/jiffies.h> +#include <linux/math64.h> /* resolution for penabled devices */ #define WACOM_PL_RES 20
@@ -1937,6 +1938,24 @@ static void wacom_wac_battery_usage_mapping(struct hid_device *hdev, return; } +static bool wacom_wac_battery_percentage(struct hid_field *field, __s32 value, + __s32 *percentage) +{ + s64 range = (s64)field->logical_maximum - field->logical_minimum; + s64 result; + + if (range <= 0) + return false; + + result = div64_s64(((s64)value - field->logical_minimum) * 100, + range); + if (result < 0 || result > 100) + return false; + + *percentage = result; + return true; +} + static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *field, struct hid_usage *usage, __s32 value) {
@@ -1950,7 +1969,8 @@ static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *f wacom_wac->hid_data.bat_status = POWER_SUPPLY_STATUS_UNKNOWN; } else { - value = value * 100 / (field->logical_maximum - field->logical_minimum); + if (!wacom_wac_battery_percentage(field, value, &value)) + return; wacom_wac->hid_data.battery_capacity = value; wacom_wac->hid_data.bat_connected = 1; wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO;
@@ -1958,7 +1978,8 @@ static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *f wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; break; case WACOM_HID_WD_BATTERY_LEVEL: - value = value * 100 / (field->logical_maximum - field->logical_minimum); + if (!wacom_wac_battery_percentage(field, value, &value)) + return; wacom_wac->hid_data.battery_capacity = value; wacom_wac->hid_data.bat_connected = 1; wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO;
--
2.43.0