Received: by 2002:a05:6a10:eb17:0:0:0:0 with SMTP id hx23csp457534pxb; Thu, 9 Sep 2021 05:03:18 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyWILlSsndljtVT/NHlh8EzdV/S3j5Ww44E8kk61yD8b0eG9bOcQDtnNImFFll6J05CFHFR X-Received: by 2002:a17:907:96a2:: with SMTP id hd34mr3075246ejc.113.1631188997327; Thu, 09 Sep 2021 05:03:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1631188997; cv=none; d=google.com; s=arc-20160816; b=nfVWJkbs1FZrtPTqrt8Y0H42Rj1z6zTnaStSLpZJeS6/t3QmASedgC7LMzhd91i0Mm zxu4lrmIq7r+zSubPtFklKXtKgdc+RkoQZm17lbAr6cKI2s2DrN8obelcndrBjK/0vmG 3Z79HbWvYvIfZPWMIMOK0kpkMBlbBd1N7Z30UBJ+DJKkByTMbEDFW27VY0mU2RmoiWsN 992u7ereq5NeiweBndQ5mdBRQ5LeFwSArl1eR4pOvbrBHuRzMDqzIdty3VItWx3cEgYH 19xeVZRwd31CNLPHBiq0KnHwwTw4bGOb8jSKAeWaH+r29fXGlHI7qI0a/Djf/qCIYWSf Bc3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=f1abGhzJn/oN3I7Z/TrGEszYCS4Erri8uJMyC2LGHyY=; b=TaPEwcZoXtldcZ4YrUeQkC7QHLXDrK5p+0HBe+OPnwKbDqzGGtiUFIf0GDeufK62HW uP4FKtGXN2quyygjFqZxTEdgO7XDH/kY5VyDzdNCatwRQ2Xrw/oBEafq+Uaxg8mA42kz JQ9f5O5xfOzq8UdxG/daanu3gYfQo3qgk+TDa/Up7xMrvIFqxwyMv16n8TAv5e6CkAuh hXGJG48eGOx1dig+8nr6LT4x4ABAdZEDG5ocGWiiiZp+6ATNqhB79o7sHWh+ZOJikpf3 rUrAe0r1dW1c545RMqqEfId2fTUmDXES+u8/jmmirhxuKdjSqQA/nMdXAB5ZGcmr0nq5 rBPA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=EjJGtPbb; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id hy16si1417830ejc.209.2021.09.09.05.02.15; Thu, 09 Sep 2021 05:03:17 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=EjJGtPbb; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242554AbhIIL61 (ORCPT + 99 others); Thu, 9 Sep 2021 07:58:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:34926 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245468AbhIILzC (ORCPT ); Thu, 9 Sep 2021 07:55:02 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id C173F613A8; Thu, 9 Sep 2021 11:45:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1631187902; bh=EFk7taVLDDEyryR2UN+6vNU2VWI9oVuX3ynm0n8vEZM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EjJGtPbbcC1CPYwERB5Kpit0dbEE5YrWNEf8iyAvLkEBcyASgFqdVMI7ywS1wjuA7 1VSQuMPVFpKQ5UnLyaIqlw+S1ItWEO0MPMsEn0SXQ4Exk7wuD6GE5ICpcKbJiU2Zxf sl3veH3X5dhv2mRv4dHb202bwFEoVdvRhOSwIXSbjBHNupQ6Eipx6NQpttMX2VChHt FLZnL2AP+NaH0GU4ntzeqiLCq9+4gG0rI0hpZzr9mUV8OYI/LzY17qaKur5vOPKN2p ITEk6K+bKTb/YZjYztMkLlccSE7ZI42TX0oo4jaBlOmy63lVmCggSwetG/vk8Lytyj TafI1lU/YQTjw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Li Jun , Zhipeng Wang , Peter Chen , Sasha Levin , linux-usb@vger.kernel.org Subject: [PATCH AUTOSEL 5.14 181/252] usb: chipidea: host: fix port index underflow and UBSAN complains Date: Thu, 9 Sep 2021 07:39:55 -0400 Message-Id: <20210909114106.141462-181-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210909114106.141462-1-sashal@kernel.org> References: <20210909114106.141462-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Li Jun [ Upstream commit e5d6a7c6cfae9e714a0e8ff64facd1ac68a784c6 ] If wIndex is 0 (and it often is), these calculations underflow and UBSAN complains, here resolve this by not decrementing the index when it is equal to 0, this copies the solution from commit 85e3990bea49 ("USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN") Reported-by: Zhipeng Wang Signed-off-by: Li Jun Link: https://lore.kernel.org/r/1624004938-2399-1-git-send-email-jun.li@nxp.com Signed-off-by: Peter Chen Signed-off-by: Sasha Levin --- drivers/usb/chipidea/host.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c index e86d13c04bdb..bdc3885c0d49 100644 --- a/drivers/usb/chipidea/host.c +++ b/drivers/usb/chipidea/host.c @@ -240,15 +240,18 @@ static int ci_ehci_hub_control( ) { struct ehci_hcd *ehci = hcd_to_ehci(hcd); + unsigned int ports = HCS_N_PORTS(ehci->hcs_params); u32 __iomem *status_reg; - u32 temp; + u32 temp, port_index; unsigned long flags; int retval = 0; bool done = false; struct device *dev = hcd->self.controller; struct ci_hdrc *ci = dev_get_drvdata(dev); - status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1]; + port_index = wIndex & 0xff; + port_index -= (port_index > 0); + status_reg = &ehci->regs->port_status[port_index]; spin_lock_irqsave(&ehci->lock, flags); @@ -260,6 +263,11 @@ static int ci_ehci_hub_control( } if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) { + if (!wIndex || wIndex > ports) { + retval = -EPIPE; + goto done; + } + temp = ehci_readl(ehci, status_reg); if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) { retval = -EPIPE; @@ -288,7 +296,7 @@ static int ci_ehci_hub_control( ehci_writel(ehci, temp, status_reg); } - set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports); + set_bit(port_index, &ehci->suspended_ports); goto done; } -- 2.30.2