From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752765AbcHUKrE (ORCPT ); Sun, 21 Aug 2016 06:47:04 -0400 Received: from mail-wm0-f46.google.com ([74.125.82.46]:38344 "EHLO mail-wm0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752162AbcHUKrB (ORCPT ); Sun, 21 Aug 2016 06:47:01 -0400 Subject: Re: UBSAN: Undefined behaviour in linux-4.7.2/drivers/usb/core/devio.c:1713:25 To: Vittorio Zecca , stable@vger.kernel.org, USB list , Linux kernel mailing list References: From: Jiri Slaby Message-ID: <48b3a1b9-e6c1-bea0-bb10-488818f7812d@suse.cz> Date: Sun, 21 Aug 2016 12:46:00 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Cc: proper lists. ep->desc.bInterval seems to be 0 here. On 08/21/2016, 12:42 PM, Vittorio Zecca wrote: > I am not sure this is the right place so please bear with me... > From Vittorio Zecca > > After compiling kernel 4.7.2 with ubsan I got the following messages > at boot time: > > (devio.c:1713 is "as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);") > > [ +0.354486] ================================================================================ > [ +0.000008] UBSAN: Undefined behaviour in > /home/vitti/1tb/vitti/rpmbuild/SOURCES/linux-4.7.2/drivers/usb/core/devio.c:1713:25 > [ +0.000004] shift exponent -1 is negative > [ +0.000005] CPU: 1 PID: 616 Comm: mtp-probe Not tainted 4.7.2sanitized #1 > [ +0.000004] Hardware name: To Be Filled By O.E.M. To Be Filled By > O.E.M./H81M-DGS R2.0, BIOS P1.30 07/02/2014 > [ +0.000003] ffffffff845f1d00 000000006774dd2e ffff880382e5f758 > ffffffff818cad70 > [ +0.000005] 0000000041b58ab3 ffffffff829ffc3e ffffffff818cacbe > ffff880382e5f780 > [ +0.000005] ffff880382e5f730 ffffffffffffffff ffff880382e5f800 > ffffffff845f1d00 > [ +0.000004] Call Trace: > [ +0.000009] [] dump_stack+0xb2/0x103 > [ +0.000006] [] ? _atomic_dec_and_lock+0x190/0x190 > [ +0.000005] [] ubsan_epilogue+0xd/0x4e > [ +0.000005] [] > __ubsan_handle_shift_out_of_bounds+0x1f4/0x24c > [ +0.000005] [] ? > __ubsan_handle_load_invalid_value+0x153/0x153 > [ +0.000007] [] ? proc_do_submiturb+0xdde/0x21a6 > [ +0.000005] [] ? memset+0x31/0x38 > [ +0.000005] [] ? usb_alloc_urb+0xd5/0x13a > [ +0.000004] [] ? kasan_unpoison_shadow+0x35/0x43 > [ +0.000004] [] ? kasan_unpoison_shadow+0x35/0x43 > [ +0.000004] [] ? kasan_kmalloc+0x5e/0x64 > [ +0.000005] [] ? __kmalloc+0x143/0x40f > [ +0.000005] [] ? lockref_put_or_lock+0x8f/0x227 > [ +0.000006] [] proc_do_submiturb+0x1cf8/0x21a6 > [ +0.000004] [] ? proc_do_submiturb+0x1cf8/0x21a6 > [ +0.000006] [] ? __alloc_pages_nodemask+0x26a/0x1ebe > [ +0.000004] [] ? cdev_put.part.0+0x46/0x46 > [ +0.000005] [] ? lockref_mark_dead+0x61/0x61 > [ +0.000005] [] ? usbdev_release+0x223/0x223 > [ +0.000005] [] ? warn_alloc_failed+0x266/0x266 > [ +0.000004] [] ? mntput+0x3b/0x5e > [ +0.000005] [] ? terminate_walk+0xfe/0x2cb > [ +0.000005] [] ? vfs_open+0xb7/0x14f > [ +0.000005] [] usbdev_do_ioctl+0x1451/0x25c7 > [ +0.000004] [] ? proc_do_submiturb+0x21a6/0x21a6 > [ +0.000005] [] ? atime_needs_update+0x28f/0x36c > [ +0.000005] [] ? new_inode+0x30/0x30 > [ +0.000005] [] ? _raw_spin_unlock_bh+0xbf/0xbf > [ +0.000006] [] ? enqueue_hrtimer+0x91/0x1c0 > [ +0.000005] [] ? lock_hrtimer_base+0x6b/0xc9 > [ +0.000005] [] ? hrtimer_start_range_ns+0x4ab/0xba9 > [ +0.000004] [] ? hrtimer_init+0xe8/0xe8 > [ +0.000005] [] ? __hrtimer_init+0xe5/0x13f > [ +0.000005] [] usbdev_ioctl+0xe/0x12 > [ +0.000004] [] do_vfs_ioctl+0x170/0xc6f > [ +0.000005] [] ? do_timerfd_settime+0x483/0x7d8 > [ +0.000004] [] ? ioctl_preallocate+0x1e3/0x1e3 > [ +0.000004] [] ? timerfd_release+0x91/0x91 > [ +0.000005] [] ? SyS_timerfd_settime+0xbd/0x143 > [ +0.000005] [] ? __fget+0xde/0x1ee > [ +0.000005] [] ? __fget_light+0xdd/0x14f > [ +0.000004] [] SyS_ioctl+0x79/0x92 > [ +0.000005] [] entry_SYSCALL_64_fastpath+0x1a/0xa4 > [ +0.000003] ================================================================================ > [ +0.424947] usbcore: registered new interface driver option > [ +0.000503] usbserial: USB Serial support registered for GSM modem (1-port) > [ +0.000363] option 3-8:1.0: GSM modem (1-port) converter detected > [ +0.003096] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB0 > [ +0.000239] option 3-8:1.2: GSM modem (1-port) converter detected > [ +0.003003] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB1 > [ +0.000198] option 3-8:1.3: GSM modem (1-port) converter detected > [ +0.002997] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB2 > [ +0.855356] iTCO_vendor_support: vendor-support=0 > [ +0.334571] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11 > [ +0.000380] iTCO_wdt: Found a Lynx Point TCO device (Version=2, > TCOBASE=0x1860) > [ +0.003131] iTCO_wdt: initialized. heartbeat=30 sec (nowayout=0) > [ +0.433888] usbcore: registered new interface driver cdc_ncm > [ +0.056852] ppdev: user-space parallel port driver > [ +0.681019] usbcore: registered new interface driver cdc_wdm > [ +0.746911] huawei_cdc_ncm 3-8:1.1: MAC-Address: 58:2c:80:13:92:63 > [ +0.000009] huawei_cdc_ncm 3-8:1.1: setting rx_max = 16384 > [ +0.000443] huawei_cdc_ncm 3-8:1.1: setting tx_max = 16384 > [ +0.000391] huawei_cdc_ncm 3-8:1.1: NDP will be placed at end of > frame for this device. > [ +0.002619] huawei_cdc_ncm 3-8:1.1: cdc-wdm0: USB WDM device > [ +0.009247] huawei_cdc_ncm 3-8:1.1 wwan0: register 'huawei_cdc_ncm' > at usb-0000:00:14.0-8, Huawei CDC NCM device, 58:2c:80:13:92:63 > [ +0.000693] usbcore: registered new interface driver huawei_cdc_ncm > [ +0.081877] huawei_cdc_ncm 3-8:1.1 wwp0s20u8i1: renamed from wwan0 > -- > To unsubscribe from this list: send the line "unsubscribe stable" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- js suse labs