Re: UBSAN: shift-out-of-bounds in drivers/media/usb/uvc/uvc_ctrl.c:781

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Laurent,

On Tue, Aug 18, 2020 at 8:54 PM Laurent Pinchart
<laurent.pinchart@xxxxxxxxxxxxxxxx> wrote:

> No, the issue is that bits is equal to -7, 1LL won't change that.
>
> Once bits become negative, the loop stops, and the mask value isn't used
> afterwards. This would only cause an issue if a shift with a negative
> value generated side effects (such as a trap for instance) on top of
> producing an incorrect result. Can this happen ? I suppose we should
> silence the warning even if it's a false positive, as it doesn't look
> good in the kernel log.

Yes, you are right.

One way to avoid the negative shift:

--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -778,7 +778,8 @@ static s32 uvc_get_le_value(struct
uvc_control_mapping *mapping,
                value |= offset > 0 ? (byte >> offset) : (byte << (-offset));
                bits -= 8 - (offset > 0 ? offset : 0);
                offset -= 8;
-               mask = (1 << bits) - 1;
+               if (bits > 0)
+                       mask = (1 << bits) - 1;
        }

        /* Sign-extend the value if needed. */

Just saw your patch where you quit the while(1) if bits <=0. Thanks!



[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]

  Powered by Linux