From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755393AbcHVU6E (ORCPT ); Mon, 22 Aug 2016 16:58:04 -0400 Received: from canardo.mork.no ([148.122.252.1]:53640 "EHLO canardo.mork.no" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932620AbcHVU6B (ORCPT ); Mon, 22 Aug 2016 16:58:01 -0400 From: =?utf-8?Q?Bj=C3=B8rn_Mork?= To: Alan Stern Cc: Jiri Slaby , Vittorio Zecca , , USB list , Linux kernel mailing list Subject: Re: UBSAN: Undefined behaviour in linux-4.7.2/drivers/usb/core/devio.c:1713:25 Organization: m References: Date: Mon, 22 Aug 2016 22:57:51 +0200 In-Reply-To: (Alan Stern's message of "Mon, 22 Aug 2016 16:40:32 -0400 (EDT)") Message-ID: <87pop0y10w.fsf@miraculix.mork.no> User-Agent: Gnus/5.130015 (Ma Gnus v0.15) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.home.local id u7MKwNiN018391 Alan Stern writes: > On Mon, 22 Aug 2016, Bjørn Mork wrote: > >> Alan Stern writes: >> >> > On Sun, 21 Aug 2016, Jiri Slaby wrote: >> > >> >> Cc: proper lists. >> >> >> >> ep->desc.bInterval seems to be 0 here. > >> > As far as I can see, this isn't possible. The usb_parse_endpoint() >> > routine in drivers/usb/core/config.c is supposed to guarantee that >> > ep->desc.bInterval is never 0. >> >> That is if it is an ISO endpoint, right? > > I can't tell; the bug report doesn't say. However, ep->desc.bInterval > is ignored for bulk and control endpoints, so it must be either > isochronous or interrupt. So what if the endpoint is not isochronous or interrupt here? >> Maybe I misunderstand something fundamental, but the "||" strikes me as >> odd here: >> >> as->urb->stream_id = stream_id; >> if (uurb->type == USBDEVFS_URB_TYPE_ISO || >> ps->dev->speed == USB_SPEED_HIGH) >> as->urb->interval = 1 << min(15, ep->desc.bInterval - 1); >> else >> as->urb->interval = ep->desc.bInterval; >> as->urb->context = as; > > No, that's right (mostly -- we really should check for ps->dev->speed >>= USB_SPEED_SUPER as well as == USB_SPEED_HIGH). > >> Typo? > > USB uses two different encodings for endpoint intervals. The second > encoding above just gives the interval in frames; this is used for low- > and full-speed interrupt endpoints. The first encoding above is > exponential (it gives n where the actual interval is 2^(n-1) frames or > microframes); this is used for all isochronous endpoints and for > high-speed (or SuperSpeed etc.) interrupt endpoints. OK, I am still puzzled: Won't the code I quoted above do the shift for *any* uurb->type and endpoint type? There doesn't seem to be any test for isochronous or interrupt endpoint around it? Bjørn