usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control()

PATCH New Shuah Khan 1 participant 1 message Mar 24, 2021

Subsystems (3)

Stable branch USB USB over IP driver

lore

Share & tools

lore

Shuah Khan

author maintainer

2021-03-24 23:07 UTC #0 lore raw

PATCH 1/1 usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control()

Fix shift out-of-bounds in vhci_hub_control() SetPortFeature handling.

UBSAN: shift-out-of-bounds in drivers/usb/usbip/vhci_hcd.c:605:42

shift exponent 768 is too large for 32-bit type 'int'

Reported-by [email protected]

Cc [email protected]

Signed-off-by Shuah Khan <[email protected]>

---
 drivers/usb/usbip/vhci_hcd.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/usb/usbip/vhci_hcd.c +2 -0

index 3209b5ddd30c..a20a8380ca0c 100644
@@ -594,6 +594,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 				pr_err("invalid port number %d\n", wIndex);
 				goto error;
 			}
+			if (wValue >= 32)
+				goto error;
 			if (hcd->speed == HCD_USB3) {
 				if ((vhci_hcd->port_status[rhport] &
 				     USB_SS_PORT_STAT_POWER) != 0) {

Signature · 1 line

2.27.0