pidff_set_duration() computes the infinite duration as (1U << report_size) - 1, but report_size comes from the device's report descriptor and can be 32 or greater. This causes an undefined shift. A UHID test on x86-64 triggers UBSAN and programs a 32-bit duration field as zero instead of 0xffffffff. For report sizes of 32 or more, store -1 in the s32 field value to set all 32 bits without shifting. Keep the existing calculation for smaller fields. Fixes: 1a575044d516 ("HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff") Cc: stable@vger.kernel.org Signed-off-by: Shengzhuo Wei --- HID: pidff: fix undefined shift for infinite duration --- drivers/hid/usbhid/hid-pidff.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c index 22951b7ecd17..25b82e7d0b9e 100644 --- a/drivers/hid/usbhid/hid-pidff.c +++ b/drivers/hid/usbhid/hid-pidff.c @@ -394,7 +394,11 @@ static void pidff_set_duration(struct pidff_usage *usage, u16 duration) { /* PID defines INFINITE as the max possible value for duration field */ if (pidff_is_duration_infinite(duration)) { - usage->value[0] = (1U << usage->field->report_size) - 1; + if (usage->field->report_size >= 32) + usage->value[0] = -1; + else + usage->value[0] = + (1U << usage->field->report_size) - 1; return; } --- base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e change-id: 20261028-b4-pidff-duration-shift-8df4f6451448 Best regards, -- Shengzhuo Wei