diff options
| author |   Laurent Pinchart <laurent.pinchart@ideasonboard.com> | 2020-08-19 01:56:49 +0200 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2020-09-10 14:06:27 +0200 |
| commit | 171994e498a0426cbe17f874c5c6af3c0af45200 (patch) | |
| tree | 8913618d845b41fb400db6e0830f5492a2f53604 /drivers/media/usb/uvc/uvc_ctrl.c | |
| parent | media: uvcvideo: Fix dereference of out-of-bound list iterator (diff) | |
| download | wireguard-linux-171994e498a0426cbe17f874c5c6af3c0af45200.tar.xz wireguard-linux-171994e498a0426cbe17f874c5c6af3c0af45200.zip | |
media: uvcvideo: Silence shift-out-of-bounds warning
UBSAN reports a shift-out-of-bounds warning in uvc_get_le_value(). The
report is correct, but the issue should be harmless as the computed
value isn't used when the shift is negative. This may however cause
incorrect behaviour if a negative shift could generate adverse side
effects (such as a trap on some architectures for instance).
Regardless of whether that may happen or not, silence the warning as a
full WARN backtrace isn't nice.
Reported-by: Bart Van Assche <bvanassche@acm.org>
Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Tested-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/media/usb/uvc/uvc_ctrl.c')
| -rw-r--r-- | drivers/media/usb/uvc/uvc_ctrl.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 76e4c8859871..f479d8971dfb 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -773,12 +773,16 @@ static s32 uvc_get_le_value(struct uvc_control_mapping *mapping, offset &= 7; mask = ((1LL << bits) - 1) << offset; - for (; bits > 0; data++) { + while (1) { u8 byte = *data & mask; value |= offset > 0 ? (byte >> offset) : (byte << (-offset)); bits -= 8 - (offset > 0 ? offset : 0); + if (bits <= 0) + break; + offset -= 8; mask = (1 << bits) - 1; + data++; } /* Sign-extend the value if needed. */ |