lkml.org 
[lkml]   [2020]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 047/264] media: uvcvideo: Silence shift-out-of-bounds warning
    Date
    From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

    [ Upstream commit 171994e498a0426cbe17f874c5c6af3c0af45200 ]

    UBSAN reports a shift-out-of-bounds warning in uvc_get_le_value(). The
    report is correct, but the issue should be harmless as the computed
    value isn't used when the shift is negative. This may however cause
    incorrect behaviour if a negative shift could generate adverse side
    effects (such as a trap on some architectures for instance).

    Regardless of whether that may happen or not, silence the warning as a
    full WARN backtrace isn't nice.

    Reported-by: Bart Van Assche <bvanassche@acm.org>
    Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Tested-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/uvc/uvc_ctrl.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
    index f2854337cdcac..abfc49901222e 100644
    --- a/drivers/media/usb/uvc/uvc_ctrl.c
    +++ b/drivers/media/usb/uvc/uvc_ctrl.c
    @@ -778,12 +778,16 @@ static s32 uvc_get_le_value(struct uvc_control_mapping *mapping,
    offset &= 7;
    mask = ((1LL << bits) - 1) << offset;

    - for (; bits > 0; data++) {
    + while (1) {
    u8 byte = *data & mask;
    value |= offset > 0 ? (byte >> offset) : (byte << (-offset));
    bits -= 8 - (offset > 0 ? offset : 0);
    + if (bits <= 0)
    + break;
    +
    offset -= 8;
    mask = (1 << bits) - 1;
    + data++;
    }

    /* Sign-extend the value if needed. */
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-10-27 15:22    [W:4.034 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site