USB: avoid left shift by -1
UBSAN complains about a left shift by -1 in proc_do_submiturb(). This can occur when an URB is submitted for a bulk or control endpoint on a high-speed device, since the code doesn't bother to check the endpoint type; normally only interrupt or isochronous endpoints have a nonzero bInterval value. Aside from the fact that the operation is illegal, it shouldn't matter because the result isn't used. Still, in theory it could cause a hardware exception or other problem, so we should work around it. This patch avoids doing the left shift unless the shift amount is >= 0. The same piece of code has another problem. When checking the device speed (the exponential encoding for interrupt endpoints is used only by high-speed or faster devices), we need to look for speed >= USB_SPEED_SUPER as well as speed == USB_SPEED HIGH. The patch adds this check. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-by: Vittorio Zecca <zeccav@gmail.com> Tested-by: Vittorio Zecca <zeccav@gmail.com> Suggested-by: Bjørn Mork <bjorn@mork.no> CC: <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
6c73358c83
commit
53e5f36fbd
|
@ -1709,11 +1709,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
|
|||
as->urb->start_frame = uurb->start_frame;
|
||||
as->urb->number_of_packets = number_of_packets;
|
||||
as->urb->stream_id = stream_id;
|
||||
if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
|
||||
ps->dev->speed == USB_SPEED_HIGH)
|
||||
as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
|
||||
else
|
||||
as->urb->interval = ep->desc.bInterval;
|
||||
|
||||
if (ep->desc.bInterval) {
|
||||
if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
|
||||
ps->dev->speed == USB_SPEED_HIGH ||
|
||||
ps->dev->speed >= USB_SPEED_SUPER)
|
||||
as->urb->interval = 1 <<
|
||||
min(15, ep->desc.bInterval - 1);
|
||||
else
|
||||
as->urb->interval = ep->desc.bInterval;
|
||||
}
|
||||
|
||||
as->urb->context = as;
|
||||
as->urb->complete = async_completed;
|
||||
for (totlen = u = 0; u < number_of_packets; u++) {
|
||||
|
|
Loading…
Reference in a new issue