[PATCH] HID: wacom: avoid overflows in sequence number tracking
From: Aldo Ariel Panzardo <hidden>
Date: 2026-09-15 11:14:58
Also in:
lkml, stable
Subsystem:
hid core layer, hid wacom driver, the rest · Maintainers:
Jiri Kosina, Benjamin Tissoires, Ping Cheng, Jason Gerecke, Linus Torvalds
The dropped-packet calculation derives the sequence range in signed
int arithmetic. A sequence field whose logical range spans all signed
32-bit values makes the range calculation wrap to zero, so the following
modulo triggers a divide exception.
Do the range and delta calculations in s64, and normalize the delta after
the modulo. Also avoid overflowing value + 1 when the received value is at
the logical maximum.
Fixes: 359673ea3a20 ("HID: wacom: Support sequence numbers smaller than 16-bit")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <redacted>
---
drivers/hid/wacom_wac.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index da1f0ea856..39ffe5e7c7 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c@@ -2530,13 +2530,21 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field case WACOM_HID_WD_SEQUENCENUMBER: if (wacom_wac->hid_data.sequence_number != value && wacom_wac->hid_data.sequence_number >= 0) { - int sequence_size = field->logical_maximum - field->logical_minimum + 1; - int drop_count = (value - wacom_wac->hid_data.sequence_number) % sequence_size; - hid_warn(hdev, "Dropped %d packets", drop_count); + s64 sequence_size = (s64)field->logical_maximum - + field->logical_minimum + 1; + s64 drop_count = (s64)value - + wacom_wac->hid_data.sequence_number; + + drop_count %= sequence_size; + if (drop_count < 0) + drop_count += sequence_size; + hid_warn(hdev, "Dropped %lld packets", + (long long)drop_count); } - wacom_wac->hid_data.sequence_number = value + 1; - if (wacom_wac->hid_data.sequence_number > field->logical_maximum) + if (value >= field->logical_maximum) wacom_wac->hid_data.sequence_number = field->logical_minimum; + else + wacom_wac->hid_data.sequence_number = value + 1; return; }
--
2.43.0