| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sun, 21 Aug 2016 12:46:00 +0200
From: Jiri Slaby <jslaby@...e.cz>
To: Vittorio Zecca <zeccav@...il.com>, stable@...r.kernel.org,
USB list <linux-usb@...r.kernel.org>,
Linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: Re: UBSAN: Undefined behaviour in
linux-4.7.2/drivers/usb/core/devio.c:1713:25
Cc: proper lists.
ep->desc.bInterval seems to be 0 here.
On 08/21/2016, 12:42 PM, Vittorio Zecca wrote:
> I am not sure this is the right place so please bear with me...
> From Vittorio Zecca
>
> After compiling kernel 4.7.2 with ubsan I got the following messages
> at boot time:
>
> (devio.c:1713 is "as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);")
>
> [ +0.354486] ================================================================================
> [ +0.000008] UBSAN: Undefined behaviour in
> /home/vitti/1tb/vitti/rpmbuild/SOURCES/linux-4.7.2/drivers/usb/core/devio.c:1713:25
> [ +0.000004] shift exponent -1 is negative
> [ +0.000005] CPU: 1 PID: 616 Comm: mtp-probe Not tainted 4.7.2sanitized #1
> [ +0.000004] Hardware name: To Be Filled By O.E.M. To Be Filled By
> O.E.M./H81M-DGS R2.0, BIOS P1.30 07/02/2014
> [ +0.000003] ffffffff845f1d00 000000006774dd2e ffff880382e5f758
> ffffffff818cad70
> [ +0.000005] 0000000041b58ab3 ffffffff829ffc3e ffffffff818cacbe
> ffff880382e5f780
> [ +0.000005] ffff880382e5f730 ffffffffffffffff ffff880382e5f800
> ffffffff845f1d00
> [ +0.000004] Call Trace:
> [ +0.000009] [<ffffffff818cad70>] dump_stack+0xb2/0x103
> [ +0.000006] [<ffffffff818cacbe>] ? _atomic_dec_and_lock+0x190/0x190
> [ +0.000005] [<ffffffff819511e3>] ubsan_epilogue+0xd/0x4e
> [ +0.000005] [<ffffffff81951cad>]
> __ubsan_handle_shift_out_of_bounds+0x1f4/0x24c
> [ +0.000005] [<ffffffff81951ab9>] ?
> __ubsan_handle_load_invalid_value+0x153/0x153
> [ +0.000007] [<ffffffff81d23fe8>] ? proc_do_submiturb+0xdde/0x21a6
> [ +0.000005] [<ffffffff814be72c>] ? memset+0x31/0x38
> [ +0.000005] [<ffffffff81d099c6>] ? usb_alloc_urb+0xd5/0x13a
> [ +0.000004] [<ffffffff814be5bf>] ? kasan_unpoison_shadow+0x35/0x43
> [ +0.000004] [<ffffffff814be5bf>] ? kasan_unpoison_shadow+0x35/0x43
> [ +0.000004] [<ffffffff814be62b>] ? kasan_kmalloc+0x5e/0x64
> [ +0.000005] [<ffffffff814b8c1a>] ? __kmalloc+0x143/0x40f
> [ +0.000005] [<ffffffff818f13f1>] ? lockref_put_or_lock+0x8f/0x227
> [ +0.000006] [<ffffffff81d24f02>] proc_do_submiturb+0x1cf8/0x21a6
> [ +0.000004] [<ffffffff81d24f02>] ? proc_do_submiturb+0x1cf8/0x21a6
> [ +0.000006] [<ffffffff813e2df8>] ? __alloc_pages_nodemask+0x26a/0x1ebe
> [ +0.000004] [<ffffffff8151635c>] ? cdev_put.part.0+0x46/0x46
> [ +0.000005] [<ffffffff818f15ea>] ? lockref_mark_dead+0x61/0x61
> [ +0.000005] [<ffffffff81d2320a>] ? usbdev_release+0x223/0x223
> [ +0.000005] [<ffffffff813e2b8e>] ? warn_alloc_failed+0x266/0x266
> [ +0.000004] [<ffffffff8155a22a>] ? mntput+0x3b/0x5e
> [ +0.000005] [<ffffffff81522f5c>] ? terminate_walk+0xfe/0x2cb
> [ +0.000005] [<ffffffff81509cf6>] ? vfs_open+0xb7/0x14f
> [ +0.000005] [<ffffffff81d26801>] usbdev_do_ioctl+0x1451/0x25c7
> [ +0.000004] [<ffffffff81d253b0>] ? proc_do_submiturb+0x21a6/0x21a6
> [ +0.000005] [<ffffffff81550407>] ? atime_needs_update+0x28f/0x36c
> [ +0.000005] [<ffffffff81550178>] ? new_inode+0x30/0x30
> [ +0.000005] [<ffffffff822087ad>] ? _raw_spin_unlock_bh+0xbf/0xbf
> [ +0.000006] [<ffffffff8124f149>] ? enqueue_hrtimer+0x91/0x1c0
> [ +0.000005] [<ffffffff8124edab>] ? lock_hrtimer_base+0x6b/0xc9
> [ +0.000005] [<ffffffff812509a1>] ? hrtimer_start_range_ns+0x4ab/0xba9
> [ +0.000004] [<ffffffff812504f6>] ? hrtimer_init+0xe8/0xe8
> [ +0.000005] [<ffffffff8124f65c>] ? __hrtimer_init+0xe5/0x13f
> [ +0.000005] [<ffffffff81d27999>] usbdev_ioctl+0xe/0x12
> [ +0.000004] [<ffffffff81537d1f>] do_vfs_ioctl+0x170/0xc6f
> [ +0.000005] [<ffffffff815bf17b>] ? do_timerfd_settime+0x483/0x7d8
> [ +0.000004] [<ffffffff81537baf>] ? ioctl_preallocate+0x1e3/0x1e3
> [ +0.000004] [<ffffffff815becf8>] ? timerfd_release+0x91/0x91
> [ +0.000005] [<ffffffff815c0247>] ? SyS_timerfd_settime+0xbd/0x143
> [ +0.000005] [<ffffffff81551968>] ? __fget+0xde/0x1ee
> [ +0.000005] [<ffffffff81552695>] ? __fget_light+0xdd/0x14f
> [ +0.000004] [<ffffffff81538897>] SyS_ioctl+0x79/0x92
> [ +0.000005] [<ffffffff82208d72>] entry_SYSCALL_64_fastpath+0x1a/0xa4
> [ +0.000003] ================================================================================
> [ +0.424947] usbcore: registered new interface driver option
> [ +0.000503] usbserial: USB Serial support registered for GSM modem (1-port)
> [ +0.000363] option 3-8:1.0: GSM modem (1-port) converter detected
> [ +0.003096] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB0
> [ +0.000239] option 3-8:1.2: GSM modem (1-port) converter detected
> [ +0.003003] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB1
> [ +0.000198] option 3-8:1.3: GSM modem (1-port) converter detected
> [ +0.002997] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB2
> [ +0.855356] iTCO_vendor_support: vendor-support=0
> [ +0.334571] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11
> [ +0.000380] iTCO_wdt: Found a Lynx Point TCO device (Version=2,
> TCOBASE=0x1860)
> [ +0.003131] iTCO_wdt: initialized. heartbeat=30 sec (nowayout=0)
> [ +0.433888] usbcore: registered new interface driver cdc_ncm
> [ +0.056852] ppdev: user-space parallel port driver
> [ +0.681019] usbcore: registered new interface driver cdc_wdm
> [ +0.746911] huawei_cdc_ncm 3-8:1.1: MAC-Address: 58:2c:80:13:92:63
> [ +0.000009] huawei_cdc_ncm 3-8:1.1: setting rx_max = 16384
> [ +0.000443] huawei_cdc_ncm 3-8:1.1: setting tx_max = 16384
> [ +0.000391] huawei_cdc_ncm 3-8:1.1: NDP will be placed at end of
> frame for this device.
> [ +0.002619] huawei_cdc_ncm 3-8:1.1: cdc-wdm0: USB WDM device
> [ +0.009247] huawei_cdc_ncm 3-8:1.1 wwan0: register 'huawei_cdc_ncm'
> at usb-0000:00:14.0-8, Huawei CDC NCM device, 58:2c:80:13:92:63
> [ +0.000693] usbcore: registered new interface driver huawei_cdc_ncm
> [ +0.081877] huawei_cdc_ncm 3-8:1.1 wwp0s20u8i1: renamed from wwan0
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
js
suse labs
Powered by blists - more mailing lists