linux

iv/linux

History

Alan Stern 53e5f36fbd USB: avoid left shift by -1

UBSAN complains about a left shift by -1 in proc_do_submiturb().  This
can occur when an URB is submitted for a bulk or control endpoint on
a high-speed device, since the code doesn't bother to check the
endpoint type; normally only interrupt or isochronous endpoints have
a nonzero bInterval value.

Aside from the fact that the operation is illegal, it shouldn't matter
because the result isn't used.  Still, in theory it could cause a
hardware exception or other problem, so we should work around it.
This patch avoids doing the left shift unless the shift amount is >= 0.

The same piece of code has another problem.  When checking the device
speed (the exponential encoding for interrupt endpoints is used only
by high-speed or faster devices), we need to look for speed >=
USB_SPEED_SUPER as well as speed == USB_SPEED HIGH.  The patch adds
this check.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Vittorio Zecca <zeccav@gmail.com>
Tested-by: Vittorio Zecca <zeccav@gmail.com>
Suggested-by: Bjørn Mork <bjorn@mork.no>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2016-08-23 16:35:20 -04:00

buffer.c

usb: core: buffer: avoid NULL pointer dereferrence

2016-04-28 12:35:36 -07:00

config.c

USB: fix typo in wMaxPacketSize validation

2016-08-23 06:54:32 -04:00

devices.c

usb: core: rename mutex usb_bus_list_lock to usb_bus_idr_lock

2016-02-06 21:55:57 -08:00

devio.c

USB: avoid left shift by -1