From: Changming Liu <liu.changm@northeastern.edu>
To: Greg KH <greg@kroah.com>
Cc: "thomas@winischhofer.net" <thomas@winischhofer.net>,
"linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
"Lu, Long" <l.lu@northeastern.edu>,
"yaohway@gmail.com" <yaohway@gmail.com>
Subject: RE: [PATCH] USB: sisusbvga: Fix left shifting a possible negative value
Date: Wed, 20 May 2020 18:14:09 +0000 [thread overview]
Message-ID: <BL0PR06MB45484699A1AA2D89918E9FDFE5B60@BL0PR06MB4548.namprd06.prod.outlook.com> (raw)
In-Reply-To: <20200520164707.GB66231@kroah.com>
> -----Original Message-----
> From: Greg KH <greg@kroah.com>
> Sent: Wednesday, May 20, 2020 12:47 PM
> To: Changming Liu <liu.changm@northeastern.edu>
> Cc: thomas@winischhofer.net; linux-usb@vger.kernel.org; Lu, Long
> <l.lu@northeastern.edu>; yaohway@gmail.com
> Subject: Re: [PATCH] USB: sisusbvga: Fix left shifting a possible negative value
>
> On Wed, May 20, 2020 at 04:37:50PM +0000, Changming Liu wrote:
> >
> >
> > > -----Original Message-----
> > > From: Greg KH <greg@kroah.com>
> > > Sent: Wednesday, May 20, 2020 1:02 AM
> > > To: Changming Liu <liu.changm@northeastern.edu>
> > > Cc: thomas@winischhofer.net; linux-usb@vger.kernel.org; Lu, Long
> > > <l.lu@northeastern.edu>; yaohway@gmail.com
> > > Subject: Re: [Bug Report] drivers/usb/misc/sisusbvga: undefined
> > > result when left shift a possible negative value in
> > > sisusb_write_mem_bulk
> > >
> > > On Wed, May 20, 2020 at 03:51:04AM +0000, Changming Liu wrote:
> > > > Hi Greg and Thomas,
> > > > Greetings, I'm a first-year PhD student who is interested in the
> > > > usage of
> > > UBSan for linux. And after some experiments, I've found that in
> > > drivers/usb/misc/sisusbvga/sisusb.c
> > > > function sisusb_write_mem_bulk, there is an undefined behavior
> > > > caused by
> > > left shifting a possible negative number.
> > > >
> > > > More specifically, in the switch statement for case 3, after
> > > > executing
> > > copy_from_user, the the lower 3 bytes of char buf[4] are filled with
> > > data from user space.
> > > > And these 3 bytes are left shifted accordingly to form a 32bit
> > > > unsigned
> > > integer, swap32.
> > > >
> > > > The potential problem is, since the buf is declared as signed char
> > > > buffer so
> > > each byte might be a negative number while being left shifted.
> > > According to the C standard, when the left-hand operand of the left
> > > shift operator is a negative value, the result is undefined. So I
> > > guess change the buf declaration to unsigned will help? Given that it's only
> used here.
> > >
> > > Sounds like a good idea, patches are welcome to fix this.
> >
> > Hi greg,
> > Thank you for this recognition! This means a lot to me.
> > Here's the patch as we agreed.
>
> Please resend this in a normal format where we can properly review it.
Sure, I'm so sorry for this inconvenience, I've sent you a separate patch , hope this works.
>
> But:
>
> >
> > Best,
> > Changming
> >
> >
> > >From 14ae7c67ea3fb96ed6bea0bc9919f3c597308813 Mon Sep 17 00:00:00
> > >2001
> > From: Changming Liu <liu.changm@northeastern.edu>
> > Date: Wed, 20 May 2020 12:19:37 -0400
> > Subject: [PATCH] USB: sisusbvga: Fix left shifting a possible negative
> > value
> >
> > the char buffer buf, accepts user data which might be negative value and the
> content is left shifted to form an unsigned integer.
> > Since left shifting a negative value is undefined behavior, thus
> > change the char to u8 to fix this
>
> Properly line-wrap your changelog when you resend this.
[Changming Liu]
Got it, I believe in my patch, I properly line-wrapped the line, I hope the patch you received is well-formatted.
Otherwise, I'll have to send through my gmail account.
Sorry again for this inconvenience.
Best,
Changming
next prev parent reply other threads:[~2020-05-20 18:14 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-20 16:37 [PATCH] USB: sisusbvga: Fix left shifting a possible negative value Changming Liu
2020-05-20 16:47 ` Greg KH
2020-05-20 18:14 ` Changming Liu [this message]
2020-05-20 18:06 Changming Liu
2020-05-21 7:36 ` Greg KH
2020-05-21 17:56 ` Changming Liu
2020-05-22 7:24 ` Greg KH
2020-05-22 19:14 ` Changming Liu
2020-05-23 6:13 ` Greg KH
2020-06-05 22:13 ` Changming Liu
2020-06-14 9:37 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=BL0PR06MB45484699A1AA2D89918E9FDFE5B60@BL0PR06MB4548.namprd06.prod.outlook.com \
--to=liu.changm@northeastern.edu \
--cc=greg@kroah.com \
--cc=l.lu@northeastern.edu \
--cc=linux-usb@vger.kernel.org \
--cc=thomas@winischhofer.net \
--cc=yaohway@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).