usb: usbip: vhci_hcd: protect shift size
commit5.4-rM2-2.2.x-imx-squashed718bf42b11
upstream. Fix shift out-of-bounds in vhci_hcd.c: UBSAN: shift-out-of-bounds in ../drivers/usb/usbip/vhci_hcd.c:399:41 shift exponent 768 is too large for 32-bit type 'int' Fixes:03cd00d538
("usbip: vhci-hcd: Set the vhci structure up to work") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: syzbot+297d20e437b79283bf6d@syzkaller.appspotmail.com Cc: Yuyang Du <yuyang.du@intel.com> Cc: Shuah Khan <shuahkh@osg.samsung.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: linux-usb@vger.kernel.org Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20201229071309.18418-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
f7cc27eb35
commit
a7b81d0d2e
|
@ -396,6 +396,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
|
|||
default:
|
||||
usbip_dbg_vhci_rh(" ClearPortFeature: default %x\n",
|
||||
wValue);
|
||||
if (wValue >= 32)
|
||||
goto error;
|
||||
vhci_hcd->port_status[rhport] &= ~(1 << wValue);
|
||||
break;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue