public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Gaosheng Cui <cuigaosheng1@huawei.com>,
	Andrew Lunn <andrew@lunn.ch>, Jakub Kicinski <kuba@kernel.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.19 22/48] net: mdio: fix undefined behavior in bit shift for __mdiobus_register
Date: Tue,  8 Nov 2022 14:39:07 +0100	[thread overview]
Message-ID: <20221108133330.300628005@linuxfoundation.org> (raw)
In-Reply-To: <20221108133329.533809494@linuxfoundation.org>

From: Gaosheng Cui <cuigaosheng1@huawei.com>

[ Upstream commit 40e4eb324c59e11fcb927aa46742d28aba6ecb8a ]

Shifting signed 32-bit value by 31 bits is undefined, so changing
significant bit to unsigned. The UBSAN warning calltrace like below:

UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27
left shift of 1 by 31 places cannot be represented in type 'int'
Call Trace:
 <TASK>
 dump_stack_lvl+0x7d/0xa5
 dump_stack+0x15/0x1b
 ubsan_epilogue+0xe/0x4e
 __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c
 __mdiobus_register+0x49d/0x4e0
 fixed_mdio_bus_init+0xd8/0x12d
 do_one_initcall+0x76/0x430
 kernel_init_freeable+0x3b3/0x422
 kernel_init+0x24/0x1e0
 ret_from_fork+0x1f/0x30
 </TASK>

Fixes: 4fd5f812c23c ("phylib: allow incremental scanning of an mii bus")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20221031132645.168421-1-cuigaosheng1@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/mdio_bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index efdac68da7f4..1d1fbd7bd6fc 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -412,7 +412,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
 		bus->reset(bus);
 
 	for (i = 0; i < PHY_MAX_ADDR; i++) {
-		if ((bus->phy_mask & (1 << i)) == 0) {
+		if ((bus->phy_mask & BIT(i)) == 0) {
 			struct phy_device *phydev;
 
 			phydev = mdiobus_scan(bus, i);
-- 
2.35.1




  parent reply	other threads:[~2022-11-08 13:45 UTC|newest]

Thread overview: 54+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-11-08 13:38 [PATCH 4.19 00/48] 4.19.265-rc1 review Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 01/48] NFSv4.1: Handle RECLAIM_COMPLETE trunking errors Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 02/48] NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 03/48] nfs4: Fix kmemleak when allocate slot failed Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 04/48] net: dsa: Fix possible memory leaks in dsa_loop_init() Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 05/48] RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 06/48] nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 07/48] nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 08/48] net: fec: fix improper use of NETDEV_TX_BUSY Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 09/48] ata: pata_legacy: fix pdc20230_set_piomode() Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 10/48] net: sched: Fix use after free in red_enqueue() Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 11/48] net: tun: fix bugs for oversize packet when napi frags enabled Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 12/48] ipvs: use explicitly signed chars Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 13/48] ipvs: fix WARNING in __ip_vs_cleanup_batch() Greg Kroah-Hartman
2022-11-08 13:38 ` [PATCH 4.19 14/48] ipvs: fix WARNING in ip_vs_app_net_cleanup() Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 15/48] rose: Fix NULL pointer dereference in rose_send_frame() Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 16/48] mISDN: fix possible memory leak in mISDN_register_device() Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 17/48] isdn: mISDN: netjet: fix wrong check of device registration Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 18/48] btrfs: fix inode list leak during backref walking at resolve_indirect_refs() Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 19/48] btrfs: fix ulist leaks in error paths of qgroup self tests Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 20/48] Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 21/48] Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() Greg Kroah-Hartman
2022-11-08 13:39 ` Greg Kroah-Hartman [this message]
2022-11-08 13:39 ` [PATCH 4.19 23/48] net, neigh: Fix null-ptr-deref in neigh_table_clear() Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 24/48] ipv6: fix WARNING in ip6_route_net_exit_late() Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 25/48] media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 26/48] media: cros-ec-cec: " Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 27/48] media: dvb-frontends/drxk: initialize err to 0 Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 28/48] HID: saitek: add madcatz variant of MMO7 mouse device ID Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 29/48] i2c: xiic: Add platform module alias Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 30/48] Bluetooth: L2CAP: Fix attempting to access uninitialized memory Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 31/48] block, bfq: protect bfqd->queued by bfqd->lock Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 32/48] btrfs: fix type of parameter generation in btrfs_get_dentry Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 33/48] tcp/udp: Make early_demux back namespacified Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 34/48] kprobe: reverse kp->flags when arm_kprobe failed Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 35/48] tracing/histogram: Update document for KEYS_MAX size Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 36/48] capabilities: fix potential memleak on error path from vfs_getxattr_alloc() Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 37/48] ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 38/48] efi: random: reduce seed size to 32 bytes Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 39/48] parisc: Make 8250_gsc driver dependend on CONFIG_PARISC Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 40/48] parisc: Export iosapic_serial_irq() symbol for serial port driver Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 41/48] parisc: Avoid printing the hardware path twice Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 42/48] ext4: fix warning in ext4_da_release_space Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 43/48] KVM: x86: Mask off reserved bits in CPUID.80000008H Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 44/48] KVM: x86: emulator: em_sysexit should update ctxt->mode Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 45/48] KVM: x86: emulator: introduce emulator_recalc_and_set_mode Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 46/48] KVM: x86: emulator: update the emulation mode after CR0 write Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 47/48] linux/bits.h: make BIT(), GENMASK(), and friends available in assembly Greg Kroah-Hartman
2022-11-08 13:39 ` [PATCH 4.19 48/48] wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() Greg Kroah-Hartman
2022-11-08 15:13 ` [PATCH 4.19 00/48] 4.19.265-rc1 review Pavel Machek
2022-11-09  2:57 ` Guenter Roeck
2022-11-09 13:19 ` Naresh Kamboju
2022-11-10  1:57 ` Shuah Khan
2022-11-10 10:48 ` Sudip Mukherjee

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221108133330.300628005@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=andrew@lunn.ch \
    --cc=cuigaosheng1@huawei.com \
    --cc=kuba@kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox