backport: HID: wacom: avoid integer overflow in wacom_intuos_inout()

If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
operations and integer promotions are done, high bits in
wacom->serial[idx] will be filled with 1s as well.
Avoid this, albeit unlikely, issue by specifying left operand's __u64
type for the right operand.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization")
Signed-off-by: Nikita Zhandarovich <[email protected]>
Reviewed-by: Ping Cheng <[email protected]>
Cc: [email protected]
Signed-off-by: Jiri Kosina <[email protected]>
[[email protected]: Imported into input-wacom repository (bd249b91977b)]
Signed-off-by: Joshua Dickens <[email protected]>
[[email protected]: Backported into input-wacom repository (e0c3e13)]
Signed-off-by: Joshua Dickens <[email protected]>

Author: Nikita Zhandarovich

3.17/wacom_wac.c

@@ -841,7 +841,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
 	/* Enter report */
 	if ((data[1] & 0xfc) == 0xc0) {
 		/* serial number of the tool */
-		wacom->serial[idx] = ((data[3] & 0x0f) << 28) +
+		wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) +
 			(data[4] << 20) + (data[5] << 12) +
 			(data[6] << 4) + (data[7] >> 4);