Re: UBSAN: Undefined behaviour in linux-4.7.2/drivers/usb/core/devio.c:1713:25

[Jiri Slaby]

Cc: proper lists.

ep->desc.bInterval seems to be 0 here.

On 08/21/2016, 12:42 PM, Vittorio Zecca wrote:
> I am not sure this is the right place so please bear with me...
> From Vittorio Zecca
> 
> After compiling kernel 4.7.2 with ubsan I got the following messages
> at boot time:
> 
> (devio.c:1713 is "as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);")
> 
> [  +0.354486] ================================================================================
> [  +0.000008] UBSAN: Undefined behaviour in
> /home/vitti/1tb/vitti/rpmbuild/SOURCES/linux-4.7.2/drivers/usb/core/devio.c:1713:25
> [  +0.000004] shift exponent -1 is negative
> [  +0.000005] CPU: 1 PID: 616 Comm: mtp-probe Not tainted 4.7.2sanitized #1
> [  +0.000004] Hardware name: To Be Filled By O.E.M. To Be Filled By
> O.E.M./H81M-DGS R2.0, BIOS P1.30 07/02/2014
> [  +0.000003]  ffffffff845f1d00 000000006774dd2e ffff880382e5f758
> ffffffff818cad70
> [  +0.000005]  0000000041b58ab3 ffffffff829ffc3e ffffffff818cacbe
> ffff880382e5f780
> [  +0.000005]  ffff880382e5f730 ffffffffffffffff ffff880382e5f800
> ffffffff845f1d00
> [  +0.000004] Call Trace:
> [  +0.000009]  [<ffffffff818cad70>] dump_stack+0xb2/0x103
> [  +0.000006]  [<ffffffff818cacbe>] ? _atomic_dec_and_lock+0x190/0x190
> [  +0.000005]  [<ffffffff819511e3>] ubsan_epilogue+0xd/0x4e
> [  +0.000005]  [<ffffffff81951cad>]
> __ubsan_handle_shift_out_of_bounds+0x1f4/0x24c
> [  +0.000005]  [<ffffffff81951ab9>] ?
> __ubsan_handle_load_invalid_value+0x153/0x153
> [  +0.000007]  [<ffffffff81d23fe8>] ? proc_do_submiturb+0xdde/0x21a6
> [  +0.000005]  [<ffffffff814be72c>] ? memset+0x31/0x38
> [  +0.000005]  [<ffffffff81d099c6>] ? usb_alloc_urb+0xd5/0x13a
> [  +0.000004]  [<ffffffff814be5bf>] ? kasan_unpoison_shadow+0x35/0x43
> [  +0.000004]  [<ffffffff814be5bf>] ? kasan_unpoison_shadow+0x35/0x43
> [  +0.000004]  [<ffffffff814be62b>] ? kasan_kmalloc+0x5e/0x64
> [  +0.000005]  [<ffffffff814b8c1a>] ? __kmalloc+0x143/0x40f
> [  +0.000005]  [<ffffffff818f13f1>] ? lockref_put_or_lock+0x8f/0x227
> [  +0.000006]  [<ffffffff81d24f02>] proc_do_submiturb+0x1cf8/0x21a6
> [  +0.000004]  [<ffffffff81d24f02>] ? proc_do_submiturb+0x1cf8/0x21a6
> [  +0.000006]  [<ffffffff813e2df8>] ? __alloc_pages_nodemask+0x26a/0x1ebe
> [  +0.000004]  [<ffffffff8151635c>] ? cdev_put.part.0+0x46/0x46
> [  +0.000005]  [<ffffffff818f15ea>] ? lockref_mark_dead+0x61/0x61
> [  +0.000005]  [<ffffffff81d2320a>] ? usbdev_release+0x223/0x223
> [  +0.000005]  [<ffffffff813e2b8e>] ? warn_alloc_failed+0x266/0x266
> [  +0.000004]  [<ffffffff8155a22a>] ? mntput+0x3b/0x5e
> [  +0.000005]  [<ffffffff81522f5c>] ? terminate_walk+0xfe/0x2cb
> [  +0.000005]  [<ffffffff81509cf6>] ? vfs_open+0xb7/0x14f
> [  +0.000005]  [<ffffffff81d26801>] usbdev_do_ioctl+0x1451/0x25c7
> [  +0.000004]  [<ffffffff81d253b0>] ? proc_do_submiturb+0x21a6/0x21a6
> [  +0.000005]  [<ffffffff81550407>] ? atime_needs_update+0x28f/0x36c
> [  +0.000005]  [<ffffffff81550178>] ? new_inode+0x30/0x30
> [  +0.000005]  [<ffffffff822087ad>] ? _raw_spin_unlock_bh+0xbf/0xbf
> [  +0.000006]  [<ffffffff8124f149>] ? enqueue_hrtimer+0x91/0x1c0
> [  +0.000005]  [<ffffffff8124edab>] ? lock_hrtimer_base+0x6b/0xc9
> [  +0.000005]  [<ffffffff812509a1>] ? hrtimer_start_range_ns+0x4ab/0xba9
> [  +0.000004]  [<ffffffff812504f6>] ? hrtimer_init+0xe8/0xe8
> [  +0.000005]  [<ffffffff8124f65c>] ? __hrtimer_init+0xe5/0x13f
> [  +0.000005]  [<ffffffff81d27999>] usbdev_ioctl+0xe/0x12
> [  +0.000004]  [<ffffffff81537d1f>] do_vfs_ioctl+0x170/0xc6f
> [  +0.000005]  [<ffffffff815bf17b>] ? do_timerfd_settime+0x483/0x7d8
> [  +0.000004]  [<ffffffff81537baf>] ? ioctl_preallocate+0x1e3/0x1e3
> [  +0.000004]  [<ffffffff815becf8>] ? timerfd_release+0x91/0x91
> [  +0.000005]  [<ffffffff815c0247>] ? SyS_timerfd_settime+0xbd/0x143
> [  +0.000005]  [<ffffffff81551968>] ? __fget+0xde/0x1ee
> [  +0.000005]  [<ffffffff81552695>] ? __fget_light+0xdd/0x14f
> [  +0.000004]  [<ffffffff81538897>] SyS_ioctl+0x79/0x92
> [  +0.000005]  [<ffffffff82208d72>] entry_SYSCALL_64_fastpath+0x1a/0xa4
> [  +0.000003] ================================================================================
> [  +0.424947] usbcore: registered new interface driver option
> [  +0.000503] usbserial: USB Serial support registered for GSM modem (1-port)
> [  +0.000363] option 3-8:1.0: GSM modem (1-port) converter detected
> [  +0.003096] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB0
> [  +0.000239] option 3-8:1.2: GSM modem (1-port) converter detected
> [  +0.003003] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB1
> [  +0.000198] option 3-8:1.3: GSM modem (1-port) converter detected
> [  +0.002997] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB2
> [  +0.855356] iTCO_vendor_support: vendor-support=0
> [  +0.334571] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11
> [  +0.000380] iTCO_wdt: Found a Lynx Point TCO device (Version=2,
> TCOBASE=0x1860)
> [  +0.003131] iTCO_wdt: initialized. heartbeat=30 sec (nowayout=0)
> [  +0.433888] usbcore: registered new interface driver cdc_ncm
> [  +0.056852] ppdev: user-space parallel port driver
> [  +0.681019] usbcore: registered new interface driver cdc_wdm
> [  +0.746911] huawei_cdc_ncm 3-8:1.1: MAC-Address: 58:2c:80:13:92:63
> [  +0.000009] huawei_cdc_ncm 3-8:1.1: setting rx_max = 16384
> [  +0.000443] huawei_cdc_ncm 3-8:1.1: setting tx_max = 16384
> [  +0.000391] huawei_cdc_ncm 3-8:1.1: NDP will be placed at end of
> frame for this device.
> [  +0.002619] huawei_cdc_ncm 3-8:1.1: cdc-wdm0: USB WDM device
> [  +0.009247] huawei_cdc_ncm 3-8:1.1 wwan0: register 'huawei_cdc_ncm'
> at usb-0000:00:14.0-8, Huawei CDC NCM device, 58:2c:80:13:92:63
> [  +0.000693] usbcore: registered new interface driver huawei_cdc_ncm
> [  +0.081877] huawei_cdc_ncm 3-8:1.1 wwp0s20u8i1: renamed from wwan0
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 


-- 
js
suse labs