Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <1c8ff405-2bfe-37ff-42ba-aa4f81853475@suse.com>
Date:   Mon, 26 Jun 2023 07:48:05 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.12.0
Subject: Re: [PATCH] xen: fix potential shift out-of-bounds in
 xenhcd_hub_control()
Content-Language: en-US
To:     Zhang Shurong <zhang_shurong@foxmail.com>
Cc:     gregkh@linuxfoundation.org, xen-devel@lists.xenproject.org,
        linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
        jgross@suse.com
References: <tencent_15DD79B42AD8A0D64A7CDC24D4FE6C85800A@qq.com>
From:   Jan Beulich <jbeulich@suse.com>
In-Reply-To: <tencent_15DD79B42AD8A0D64A7CDC24D4FE6C85800A@qq.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?WVlpZU05cU40enFtSWlDVDZuSmdPMHo1Y1d0ZFhhVVR2eEM1TFM4OHVlSUZQ?=
 =?utf-8?B?bFRQZ2FscEZUaVZXcXlUSk02ek9ZZGpsdkpTM0JiQnhiYzB1UjMvVGFzQXl0?=
 =?utf-8?B?MzlaZW00QXR3ZUxHM2JKUXNCVkM2M3krUmhHWHhmamNmaEFFN21OT0ZLQ1B2?=
 =?utf-8?B?OSszdnIrY1hvaWlRRW8vYlVkVHdIZHFBZWxWbTk3QUhLTmpaQnBqOEdIMnU3?=
 =?utf-8?B?N2l4a0dHZ3FvN1I5VG9tVzNTTGpSeVF5ektOM3czRWhqaWVEVDV5bkRteUdV?=
 =?utf-8?B?ZWRtSjRIeXYyV1haYUI4WkhXY1pWQlc3ZkxrRmxDVXhkcHRrWjZFV2VKRlU5?=
 =?utf-8?B?bzJTYU1PQmdyYTNTclZWRS9tQ3N1YlU4ZGl5ZGhDSVZQbFdJWUpObk91ZDhM?=
 =?utf-8?B?bkxWeEdRM05BM2N0b1VtVGN1S3NHd2JMTERQcy9hODBqZUo3eWt5ZFc2Y0li?=
 =?utf-8?B?N2dhVy9vVXJOQzdPZDRBS0xRTEZUSEg3K3NBR1JEa2RjK1pRcGlGdjFXV2dr?=
 =?utf-8?B?Q3c5aDJxMzN5SWF3Q0lvcVZaZ0FWR0JpWDRMaWZ3RWVySzFUR3I4cWtvWDNR?=
 =?utf-8?B?NHd0bFpraHpJYUJNWmxrR1FZRml3cllwWHlLMGJ0bWVmWkdaSzNzNjROd05Y?=
 =?utf-8?B?RDlJWEMvV2d4U2swdmQrV09rZmdZMkhYdW9OeDVyZnlRckZNTHNDeVArcVNN?=
 =?utf-8?B?aGxnZ3ErRGxHUTRGb0pQY2FIVVZpek1zUElNZVNXUDVpTkpqQ2JkL3UzdjNI?=
 =?utf-8?B?c01wR3Vpa2hKUVNrV3FNdHQwRm0vSWRBeFAxay8zQWx0VE1kRjZTeVZVRldm?=
 =?utf-8?B?dkNiWlczc0IxMU01TEVnRlhFa1BaYnRQMkEzaHQvNlZVdmZZUmRuelBEZ0hW?=
 =?utf-8?B?TXFpL2lPUXNsSSttNkNXc1p1bmZvTDltV1h2UGJHbzlWRFB0eFM1TXdyam4z?=
 =?utf-8?B?dXFzdkd1OVB4eGxISmRZVmpnSEV2dnFzR2V6MGlKaHU0UlExYmVvQ1pkSWVi?=
 =?utf-8?B?ZXJVR2hqaTUrMkN2alpsVXFXc2VJNUJvL1Q2SExJRlA2WktreU1FZGJVT0Z1?=
 =?utf-8?B?bHV3UkxkdmdpYlFnVGNNR0NuZUY2bTdUdW5QY3VWd3k2d0NaWkFkTFNmaWtC?=
 =?utf-8?B?TVFyZVcrVHRNYnFTSWFxTWhmR1RZbGFRcXhoRUpjaDBqanhMMWFhZ1NSc0Nk?=
 =?utf-8?B?YXhaRDVVVUUzaEhBQUkwZGEyMjVId01MejM2b1NnVm9HWkxPRzhCbkx4L2px?=
 =?utf-8?B?OEZzN1BHMWNGU0JVT2NvNU5BQkw0SDV3VWxHczdvV2M2QkFMWmNxMDBCMmd2?=
 =?utf-8?B?TDhIUURRNVlQRC9TR0hGVnFEUEVvZGpqTHdCSUE3ck9JWUdocmhpVXU4VTVr?=
 =?utf-8?B?S2tPYnQ1bVZWRlBwZUVucDFkYVJMNk9KN05WRVNRWXdQbkx2c3AyUC8vajlh?=
 =?utf-8?B?emJyNjkrMXBEeUJ1ZXNvWmpxM3BlZEZ4ZlZEakx5WSszOUpEMEhQWjlKaUUr?=
 =?utf-8?B?RmMvcHExS253VTVIU3VaRW9heXE1dmt6QWMrWFN1ZnhzWVVOVEZOMEFnSDVM?=
 =?utf-8?B?bHF6T05uc0M1dmNlZFJYYmdPSFM0dHR0cFltMjN3TEhMOVJOSTNOMklvOUlU?=
 =?utf-8?B?THpncklhMm80SVFVem5pZVV1aDFRSEVTdVV5N2xPMkxkeTNHU0lYS1lJSVUv?=
 =?utf-8?B?N3lhL2IxUXRNa2pYMWljQ1dCUHZEaWlrMENCWTllMURHd3FYUzBkUDhQSW9D?=
 =?utf-8?B?ZS9aUEZtZllTYnJLOHMyaTZLK1pHS0FTUlRjdFk0K053K2paaUhQenZhb2Rw?=
 =?utf-8?B?T2lYQlZpeUpmNlZ5cnZSdkZiL0RJWWs5ZjVCTnBVSi9xRFZKY0xpVGNzNWVy?=
 =?utf-8?B?VllhclYyUTNPUFp6cXBEMjhUdTFNNVVjQzlhUXB4dzY5MEQvUDJ3YTRtS0dT?=
 =?utf-8?B?a00vdGFiUTRQZWxsaHBscFVnaHNPU3Rhak51S3RQL2ViN3Mra1JVdTUyOHJX?=
 =?utf-8?B?V3VxMmhNejFjYTZkeW1IQkx4SkZkV3luRFZyWWxtU3Q4aHE0Q3ZBUU1TMEMz?=
 =?utf-8?B?a1RSRXRZV01wS1h2N1NTZytqMmV5WnR0NkxycnR0T09qWGlYQkNsdDduWmZ5?=
 =?utf-8?Q?AgPy/d17cOBqTvxvGLuHkC2uk?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6f82fd14-42cc-436e-3c9d-08db7608eaff
X-MS-Exchange-CrossTenant-AuthSource: DU2PR04MB8790.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jun 2023 05:48:07.8926
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: pXOFLzBhORRexMX92nieAgueVNeErH35rI/2chGIpuf3PUAxqN/q6d2NyB74lJQrtFz0gUoUZ2O3nbVHDhFOhg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR04MB7028
X-Spam-Status: No, score=-2.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,SPF_HELO_PASS,
        SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 25.06.2023 18:42, Zhang Shurong wrote:
> --- a/drivers/usb/host/xen-hcd.c
> +++ b/drivers/usb/host/xen-hcd.c
> @@ -456,6 +456,8 @@ static int xenhcd_hub_control(struct usb_hcd *hcd, __u16 typeReq, __u16 wValue,
>  			info->ports[wIndex - 1].c_connection = false;
>  			fallthrough;
>  		default:
> +			if (wValue >= 32)
> +				goto error;
>  			info->ports[wIndex - 1].status &= ~(1 << wValue);

Even 31 is out of bounds (as in: UB) as long as it's 1 here rather
than 1u.

Jan