Patch "usb: usbip: vudc: fix left shift overflow" has been added to the 4.8-stable tree
Subsystems (3)
This is a note to let you know that I've just added the patch titled
usb: usbip: vudc: fix left shift overflow
to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-usbip-vudc-fix-left-shift-overflow.patch
and it can be found in the queue-4.8 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
238b7bd91b16d5a08326f858db42229b212e53d8Mon Sep 17 00:00:00 2001
From: Nicolas Iooss <[email protected]>
Date: Tue, 23 Aug 2016 17:13:29 +0200
Subject: usb: usbip: vudc: fix left shift overflow
From: Nicolas Iooss <[email protected]>
commit 238b7bd91b16d5a08326f858db42229b212e53d8 upstream.
In v_recv_cmd_submit(), urb_p->urb->pipe has the type unsigned int (which is 32-bit long on x86_64) but 11<<30 results in a 34-bit integer. Therefore the 2 leading bits are truncated and
urb_p->urb->pipe &= ~(11 << 30);
has the same meaning as
urb_p->urb->pipe &= ~(3 << 30);
This second statement seems to be how the code was intended to be written, as PIPE_ constants have values between 0 and 3.
The overflow has been detected with a clang warning:
drivers/usb/usbip/vudc_rx.c:145:27: warning: signed shift result
(0x2C0000000) requires 35 bits to represent, but 'int' only has 32
bits [-Wshift-overflow]
urb_p->urb->pipe &= ~(11 << 30);
~~ ^ ~~--- drivers/usb/usbip/vudc_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/usbip/vudc_rx.c +1 -1
@@ -142,7 +142,7 @@ static int v_recv_cmd_submit(struct vudc urb_p->urb->status = -EINPROGRESS ;/* FIXME: more pipe setup to please usbip_common */ - urb_p->urb->pipe &= ~(11 <<30 ); + urb_p->urb->pipe &= ~(3 <<30 );switch (urb_p->ep->type) {case USB_ENDPOINT_XFER_BULK : urb_p->urb->pipe |= (PIPE_BULK <<30 );
Patches currently in stable-queue which might be from [email protected] are
queue-4.8/usb-usbip-vudc-fix-left-shift-overflow.patch