lkml.org 
[lkml]   [2016]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 213/346] USB: avoid left shift by -1
    3.16.39-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alan Stern <stern@rowland.harvard.edu>

    commit 53e5f36fbd2453ad69a3369a1db62dc06c30a4aa upstream.

    UBSAN complains about a left shift by -1 in proc_do_submiturb(). This
    can occur when an URB is submitted for a bulk or control endpoint on
    a high-speed device, since the code doesn't bother to check the
    endpoint type; normally only interrupt or isochronous endpoints have
    a nonzero bInterval value.

    Aside from the fact that the operation is illegal, it shouldn't matter
    because the result isn't used. Still, in theory it could cause a
    hardware exception or other problem, so we should work around it.
    This patch avoids doing the left shift unless the shift amount is >= 0.

    The same piece of code has another problem. When checking the device
    speed (the exponential encoding for interrupt endpoints is used only
    by high-speed or faster devices), we need to look for speed >=
    USB_SPEED_SUPER as well as speed == USB_SPEED HIGH. The patch adds
    this check.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Vittorio Zecca <zeccav@gmail.com>
    Tested-by: Vittorio Zecca <zeccav@gmail.com>
    Suggested-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/usb/core/devio.c | 16 +++++++++++-----
    1 file changed, 11 insertions(+), 5 deletions(-)

    --- a/drivers/usb/core/devio.c
    +++ b/drivers/usb/core/devio.c
    @@ -1527,11 +1527,17 @@ static int proc_do_submiturb(struct usb_
    as->urb->start_frame = uurb->start_frame;
    as->urb->number_of_packets = number_of_packets;
    as->urb->stream_id = stream_id;
    - if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
    - ps->dev->speed == USB_SPEED_HIGH)
    - as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
    - else
    - as->urb->interval = ep->desc.bInterval;
    +
    + if (ep->desc.bInterval) {
    + if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
    + ps->dev->speed == USB_SPEED_HIGH ||
    + ps->dev->speed >= USB_SPEED_SUPER)
    + as->urb->interval = 1 <<
    + min(15, ep->desc.bInterval - 1);
    + else
    + as->urb->interval = ep->desc.bInterval;
    + }
    +
    as->urb->context = as;
    as->urb->complete = async_completed;
    for (totlen = u = 0; u < number_of_packets; u++) {
    \
     
     \ /
      Last update: 2016-11-14 04:36    [W:3.481 / U:0.560 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site