diff options
| author | Alan Stern <stern@rowland.harvard.edu> | 2016-08-23 15:32:51 -0400 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2016-09-12 18:59:55 -0400 |
| commit | e066faf1b61036126cbc3163fa370d4247e880dc (patch) | |
| tree | 0399f3777921321daf53eba9c1762c86617fb11b | |
| parent | 93c7ae51294639d51ef0f6fbc722daae0544f873 (diff) | |
| download | lwn-e066faf1b61036126cbc3163fa370d4247e880dc.tar.gz lwn-e066faf1b61036126cbc3163fa370d4247e880dc.zip | |
USB: avoid left shift by -1
[ Upstream commit 53e5f36fbd2453ad69a3369a1db62dc06c30a4aa ]
UBSAN complains about a left shift by -1 in proc_do_submiturb(). This
can occur when an URB is submitted for a bulk or control endpoint on
a high-speed device, since the code doesn't bother to check the
endpoint type; normally only interrupt or isochronous endpoints have
a nonzero bInterval value.
Aside from the fact that the operation is illegal, it shouldn't matter
because the result isn't used. Still, in theory it could cause a
hardware exception or other problem, so we should work around it.
This patch avoids doing the left shift unless the shift amount is >= 0.
The same piece of code has another problem. When checking the device
speed (the exponential encoding for interrupt endpoints is used only
by high-speed or faster devices), we need to look for speed >=
USB_SPEED_SUPER as well as speed == USB_SPEED HIGH. The patch adds
this check.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Vittorio Zecca <zeccav@gmail.com>
Tested-by: Vittorio Zecca <zeccav@gmail.com>
Suggested-by: Bjørn Mork <bjorn@mork.no>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
| -rw-r--r-- | drivers/usb/core/devio.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index a85eadff6bea..ea8ec9ceab68 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -1526,11 +1526,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb as->urb->start_frame = uurb->start_frame; as->urb->number_of_packets = number_of_packets; as->urb->stream_id = stream_id; - if (uurb->type == USBDEVFS_URB_TYPE_ISO || - ps->dev->speed == USB_SPEED_HIGH) - as->urb->interval = 1 << min(15, ep->desc.bInterval - 1); - else - as->urb->interval = ep->desc.bInterval; + + if (ep->desc.bInterval) { + if (uurb->type == USBDEVFS_URB_TYPE_ISO || + ps->dev->speed == USB_SPEED_HIGH || + ps->dev->speed >= USB_SPEED_SUPER) + as->urb->interval = 1 << + min(15, ep->desc.bInterval - 1); + else + as->urb->interval = ep->desc.bInterval; + } + as->urb->context = as; as->urb->complete = async_completed; for (totlen = u = 0; u < number_of_packets; u++) { |