From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from canardo.mork.no ([148.122.252.1]:53640 "EHLO canardo.mork.no" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932620AbcHVU6B (ORCPT ); Mon, 22 Aug 2016 16:58:01 -0400 From: =?utf-8?Q?Bj=C3=B8rn_Mork?= To: Alan Stern Cc: Jiri Slaby , Vittorio Zecca , , USB list , Linux kernel mailing list Subject: Re: UBSAN: Undefined behaviour in linux-4.7.2/drivers/usb/core/devio.c:1713:25 References: Date: Mon, 22 Aug 2016 22:57:51 +0200 In-Reply-To: (Alan Stern's message of "Mon, 22 Aug 2016 16:40:32 -0400 (EDT)") Message-ID: <87pop0y10w.fsf@miraculix.mork.no> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sender: stable-owner@vger.kernel.org List-ID: Alan Stern writes: > On Mon, 22 Aug 2016, Bj=C3=B8rn Mork wrote: > >> Alan Stern writes: >>=20 >> > On Sun, 21 Aug 2016, Jiri Slaby wrote: >> > >> >> Cc: proper lists. >> >>=20 >> >> ep->desc.bInterval seems to be 0 here. > >> > As far as I can see, this isn't possible. The usb_parse_endpoint()=20= =20 >> > routine in drivers/usb/core/config.c is supposed to guarantee that >> > ep->desc.bInterval is never 0. >>=20 >> That is if it is an ISO endpoint, right? > > I can't tell; the bug report doesn't say. However, ep->desc.bInterval=20 > is ignored for bulk and control endpoints, so it must be either=20 > isochronous or interrupt. So what if the endpoint is not isochronous or interrupt here? >> Maybe I misunderstand something fundamental, but the "||" strikes me as >> odd here: >>=20 >> as->urb->stream_id =3D stream_id; >> if (uurb->type =3D=3D USBDEVFS_URB_TYPE_ISO || >> ps->dev->speed =3D=3D USB_SPEED_HIGH) >> as->urb->interval =3D 1 << min(15, ep->desc.bInterval - = 1); >> else >> as->urb->interval =3D ep->desc.bInterval; >> as->urb->context =3D as; > > No, that's right (mostly -- we really should check for ps->dev->speed=20 >>=3D USB_SPEED_SUPER as well as =3D=3D USB_SPEED_HIGH). > >> Typo? > > USB uses two different encodings for endpoint intervals. The second > encoding above just gives the interval in frames; this is used for low- > and full-speed interrupt endpoints. The first encoding above is > exponential (it gives n where the actual interval is 2^(n-1) frames or > microframes); this is used for all isochronous endpoints and for > high-speed (or SuperSpeed etc.) interrupt endpoints. OK, I am still puzzled: Won't the code I quoted above do the shift for *any* uurb->type and endpoint type? There doesn't seem to be any test for isochronous or interrupt endpoint around it? Bj=C3=B8rn