All of lore.kernel.org
 help / color / mirror / Atom feed
From: Vittorio Zecca <zeccav@gmail.com>
To: stable@vger.kernel.org
Subject: UBSAN: Undefined behaviour in linux-4.7.2/drivers/usb/core/devio.c:1713:25
Date: Sun, 21 Aug 2016 12:42:49 +0200	[thread overview]
Message-ID: <CAFQ=mRQeV_UHYuU20ppHG6L=mNcr_cKxBMMM731XfWeoEO-L=g@mail.gmail.com> (raw)

I am not sure this is the right place so please bear with me...
>From Vittorio Zecca

After compiling kernel 4.7.2 with ubsan I got the following messages
at boot time:

(devio.c:1713 is "as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);")

[  +0.354486] ================================================================================
[  +0.000008] UBSAN: Undefined behaviour in
/home/vitti/1tb/vitti/rpmbuild/SOURCES/linux-4.7.2/drivers/usb/core/devio.c:1713:25
[  +0.000004] shift exponent -1 is negative
[  +0.000005] CPU: 1 PID: 616 Comm: mtp-probe Not tainted 4.7.2sanitized #1
[  +0.000004] Hardware name: To Be Filled By O.E.M. To Be Filled By
O.E.M./H81M-DGS R2.0, BIOS P1.30 07/02/2014
[  +0.000003]  ffffffff845f1d00 000000006774dd2e ffff880382e5f758
ffffffff818cad70
[  +0.000005]  0000000041b58ab3 ffffffff829ffc3e ffffffff818cacbe
ffff880382e5f780
[  +0.000005]  ffff880382e5f730 ffffffffffffffff ffff880382e5f800
ffffffff845f1d00
[  +0.000004] Call Trace:
[  +0.000009]  [<ffffffff818cad70>] dump_stack+0xb2/0x103
[  +0.000006]  [<ffffffff818cacbe>] ? _atomic_dec_and_lock+0x190/0x190
[  +0.000005]  [<ffffffff819511e3>] ubsan_epilogue+0xd/0x4e
[  +0.000005]  [<ffffffff81951cad>]
__ubsan_handle_shift_out_of_bounds+0x1f4/0x24c
[  +0.000005]  [<ffffffff81951ab9>] ?
__ubsan_handle_load_invalid_value+0x153/0x153
[  +0.000007]  [<ffffffff81d23fe8>] ? proc_do_submiturb+0xdde/0x21a6
[  +0.000005]  [<ffffffff814be72c>] ? memset+0x31/0x38
[  +0.000005]  [<ffffffff81d099c6>] ? usb_alloc_urb+0xd5/0x13a
[  +0.000004]  [<ffffffff814be5bf>] ? kasan_unpoison_shadow+0x35/0x43
[  +0.000004]  [<ffffffff814be5bf>] ? kasan_unpoison_shadow+0x35/0x43
[  +0.000004]  [<ffffffff814be62b>] ? kasan_kmalloc+0x5e/0x64
[  +0.000005]  [<ffffffff814b8c1a>] ? __kmalloc+0x143/0x40f
[  +0.000005]  [<ffffffff818f13f1>] ? lockref_put_or_lock+0x8f/0x227
[  +0.000006]  [<ffffffff81d24f02>] proc_do_submiturb+0x1cf8/0x21a6
[  +0.000004]  [<ffffffff81d24f02>] ? proc_do_submiturb+0x1cf8/0x21a6
[  +0.000006]  [<ffffffff813e2df8>] ? __alloc_pages_nodemask+0x26a/0x1ebe
[  +0.000004]  [<ffffffff8151635c>] ? cdev_put.part.0+0x46/0x46
[  +0.000005]  [<ffffffff818f15ea>] ? lockref_mark_dead+0x61/0x61
[  +0.000005]  [<ffffffff81d2320a>] ? usbdev_release+0x223/0x223
[  +0.000005]  [<ffffffff813e2b8e>] ? warn_alloc_failed+0x266/0x266
[  +0.000004]  [<ffffffff8155a22a>] ? mntput+0x3b/0x5e
[  +0.000005]  [<ffffffff81522f5c>] ? terminate_walk+0xfe/0x2cb
[  +0.000005]  [<ffffffff81509cf6>] ? vfs_open+0xb7/0x14f
[  +0.000005]  [<ffffffff81d26801>] usbdev_do_ioctl+0x1451/0x25c7
[  +0.000004]  [<ffffffff81d253b0>] ? proc_do_submiturb+0x21a6/0x21a6
[  +0.000005]  [<ffffffff81550407>] ? atime_needs_update+0x28f/0x36c
[  +0.000005]  [<ffffffff81550178>] ? new_inode+0x30/0x30
[  +0.000005]  [<ffffffff822087ad>] ? _raw_spin_unlock_bh+0xbf/0xbf
[  +0.000006]  [<ffffffff8124f149>] ? enqueue_hrtimer+0x91/0x1c0
[  +0.000005]  [<ffffffff8124edab>] ? lock_hrtimer_base+0x6b/0xc9
[  +0.000005]  [<ffffffff812509a1>] ? hrtimer_start_range_ns+0x4ab/0xba9
[  +0.000004]  [<ffffffff812504f6>] ? hrtimer_init+0xe8/0xe8
[  +0.000005]  [<ffffffff8124f65c>] ? __hrtimer_init+0xe5/0x13f
[  +0.000005]  [<ffffffff81d27999>] usbdev_ioctl+0xe/0x12
[  +0.000004]  [<ffffffff81537d1f>] do_vfs_ioctl+0x170/0xc6f
[  +0.000005]  [<ffffffff815bf17b>] ? do_timerfd_settime+0x483/0x7d8
[  +0.000004]  [<ffffffff81537baf>] ? ioctl_preallocate+0x1e3/0x1e3
[  +0.000004]  [<ffffffff815becf8>] ? timerfd_release+0x91/0x91
[  +0.000005]  [<ffffffff815c0247>] ? SyS_timerfd_settime+0xbd/0x143
[  +0.000005]  [<ffffffff81551968>] ? __fget+0xde/0x1ee
[  +0.000005]  [<ffffffff81552695>] ? __fget_light+0xdd/0x14f
[  +0.000004]  [<ffffffff81538897>] SyS_ioctl+0x79/0x92
[  +0.000005]  [<ffffffff82208d72>] entry_SYSCALL_64_fastpath+0x1a/0xa4
[  +0.000003] ================================================================================
[  +0.424947] usbcore: registered new interface driver option
[  +0.000503] usbserial: USB Serial support registered for GSM modem (1-port)
[  +0.000363] option 3-8:1.0: GSM modem (1-port) converter detected
[  +0.003096] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB0
[  +0.000239] option 3-8:1.2: GSM modem (1-port) converter detected
[  +0.003003] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB1
[  +0.000198] option 3-8:1.3: GSM modem (1-port) converter detected
[  +0.002997] usb 3-8: GSM modem (1-port) converter now attached to ttyUSB2
[  +0.855356] iTCO_vendor_support: vendor-support=0
[  +0.334571] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11
[  +0.000380] iTCO_wdt: Found a Lynx Point TCO device (Version=2,
TCOBASE=0x1860)
[  +0.003131] iTCO_wdt: initialized. heartbeat=30 sec (nowayout=0)
[  +0.433888] usbcore: registered new interface driver cdc_ncm
[  +0.056852] ppdev: user-space parallel port driver
[  +0.681019] usbcore: registered new interface driver cdc_wdm
[  +0.746911] huawei_cdc_ncm 3-8:1.1: MAC-Address: 58:2c:80:13:92:63
[  +0.000009] huawei_cdc_ncm 3-8:1.1: setting rx_max = 16384
[  +0.000443] huawei_cdc_ncm 3-8:1.1: setting tx_max = 16384
[  +0.000391] huawei_cdc_ncm 3-8:1.1: NDP will be placed at end of
frame for this device.
[  +0.002619] huawei_cdc_ncm 3-8:1.1: cdc-wdm0: USB WDM device
[  +0.009247] huawei_cdc_ncm 3-8:1.1 wwan0: register 'huawei_cdc_ncm'
at usb-0000:00:14.0-8, Huawei CDC NCM device, 58:2c:80:13:92:63
[  +0.000693] usbcore: registered new interface driver huawei_cdc_ncm
[  +0.081877] huawei_cdc_ncm 3-8:1.1 wwp0s20u8i1: renamed from wwan0

             reply	other threads:[~2016-08-21 10:42 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-08-21 10:42 Vittorio Zecca [this message]
2016-08-21 10:46 ` UBSAN: Undefined behaviour in linux-4.7.2/drivers/usb/core/devio.c:1713:25 Jiri Slaby
2016-08-22 17:43   ` Alan Stern
2016-08-22 20:21     ` Bjørn Mork
2016-08-22 20:40       ` Alan Stern
2016-08-22 20:57         ` Bjørn Mork
2016-08-22 21:06           ` Alan Stern
2016-08-22 21:45             ` Vittorio Zecca
2016-08-23 14:55               ` Alan Stern
2016-08-23 15:47                 ` Vittorio Zecca
2016-08-23 18:58                   ` Alan Stern

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAFQ=mRQeV_UHYuU20ppHG6L=mNcr_cKxBMMM731XfWeoEO-L=g@mail.gmail.com' \
    --to=zeccav@gmail.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.