Commit 26c139c2 authored Aug 19, 2020 by Laurent Pinchart Committed by Greg Kroah-Hartman Oct 29, 2020

media: uvcvideo: Silence shift-out-of-bounds warning



[ Upstream commit 171994e498a0426cbe17f874c5c6af3c0af45200 ]

UBSAN reports a shift-out-of-bounds warning in uvc_get_le_value(). The
report is correct, but the issue should be harmless as the computed
value isn't used when the shift is negative. This may however cause
incorrect behaviour if a negative shift could generate adverse side
effects (such as a trap on some architectures for instance).

Regardless of whether that may happen or not, silence the warning as a
full WARN backtrace isn't nice.

Reported-by: Bart Van Assche <bvanassche@acm.org>
Fixes: c0efd232 ("V4L/DVB (8145a): USB Video Class driver")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Tested-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 6bf923f2

drivers/media/usb/uvc/uvc_ctrl.c

+5 −1

Original line number	Original line	Diff line number	Diff line
	@@ -778,12 +778,16 @@ static s32 uvc_get_le_value(struct uvc_control_mapping *mapping,
	offset &= 7;		offset &= 7;
	mask = ((1LL << bits) - 1) << offset;		mask = ((1LL << bits) - 1) << offset;

	for (; bits > 0; data++) {		while (1) {
	u8 byte = *data & mask;		u8 byte = *data & mask;
	value \|= offset > 0 ? (byte >> offset) : (byte << (-offset));		value \|= offset > 0 ? (byte >> offset) : (byte << (-offset));
	bits -= 8 - (offset > 0 ? offset : 0);		bits -= 8 - (offset > 0 ? offset : 0);
			if (bits <= 0)
			break;

	offset -= 8;		offset -= 8;
	mask = (1 << bits) - 1;		mask = (1 << bits) - 1;
			data++;
	}		}

	/* Sign-extend the value if needed. */		/* Sign-extend the value if needed. */