From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755715AbcHVUVP (ORCPT ); Mon, 22 Aug 2016 16:21:15 -0400 Received: from canardo.mork.no ([148.122.252.1]:47018 "EHLO canardo.mork.no" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751752AbcHVUVN (ORCPT ); Mon, 22 Aug 2016 16:21:13 -0400 From: =?utf-8?Q?Bj=C3=B8rn_Mork?= To: Alan Stern Cc: Jiri Slaby , Vittorio Zecca , , USB list , Linux kernel mailing list Subject: Re: UBSAN: Undefined behaviour in linux-4.7.2/drivers/usb/core/devio.c:1713:25 Organization: m References: Date: Mon, 22 Aug 2016 22:21:01 +0200 In-Reply-To: (Alan Stern's message of "Mon, 22 Aug 2016 13:43:30 -0400 (EDT)") Message-ID: <87twecy2qa.fsf@miraculix.mork.no> User-Agent: Gnus/5.130015 (Ma Gnus v0.15) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.home.local id u7MKLJik018202 Alan Stern writes: > On Sun, 21 Aug 2016, Jiri Slaby wrote: > >> Cc: proper lists. >> >> ep->desc.bInterval seems to be 0 here. >> >> On 08/21/2016, 12:42 PM, Vittorio Zecca wrote: >> > I am not sure this is the right place so please bear with me... >> > From Vittorio Zecca >> > >> > After compiling kernel 4.7.2 with ubsan I got the following messages >> > at boot time: >> > >> > (devio.c:1713 is "as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);") >> > >> > [ +0.354486] ================================================================================ >> > [ +0.000008] UBSAN: Undefined behaviour in >> > /home/vitti/1tb/vitti/rpmbuild/SOURCES/linux-4.7.2/drivers/usb/core/devio.c:1713:25 >> > [ +0.000004] shift exponent -1 is negative > > As far as I can see, this isn't possible. The usb_parse_endpoint() > routine in drivers/usb/core/config.c is supposed to guarantee that > ep->desc.bInterval is never 0. That is if it is an ISO endpoint, right? Maybe I misunderstand something fundamental, but the "||" strikes me as odd here: as->urb->stream_id = stream_id; if (uurb->type == USBDEVFS_URB_TYPE_ISO || ps->dev->speed == USB_SPEED_HIGH) as->urb->interval = 1 << min(15, ep->desc.bInterval - 1); else as->urb->interval = ep->desc.bInterval; as->urb->context = as; Typo? Bjørn