| From 37ca4d5df92f669d5a81ada19fe7562a64f445c7 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sat, 11 Jul 2020 00:30:18 -0400 |
| Subject: USB: sisusbvga: Fix a potential UB casued by left shifting a negative |
| value |
| |
| From: Changming Liu <charley.ashbringer@gmail.com> |
| |
| [ Upstream commit 2b53a19284f537168fb506f2f40d7fda40a01162 ] |
| |
| The char buffer buf, receives data directly from user space, |
| so its content might be negative and its elements are left |
| shifted to form an unsigned integer. |
| |
| Since left shifting a negative value is undefined behavior, thus |
| change the char to u8 to elimintate this UB. |
| |
| Signed-off-by: Changming Liu <charley.ashbringer@gmail.com> |
| Link: https://lore.kernel.org/r/20200711043018.928-1-charley.ashbringer@gmail.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/usb/misc/sisusbvga/sisusb.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c |
| index 895e8c0288cf9..30b3bdc4e6761 100644 |
| --- a/drivers/usb/misc/sisusbvga/sisusb.c |
| +++ b/drivers/usb/misc/sisusbvga/sisusb.c |
| @@ -762,7 +762,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr, |
| u8 swap8, fromkern = kernbuffer ? 1 : 0; |
| u16 swap16; |
| u32 swap32, flag = (length >> 28) & 1; |
| - char buf[4]; |
| + u8 buf[4]; |
| |
| /* if neither kernbuffer not userbuffer are given, assume |
| * data in obuf |
| -- |
| 2.25.1 |
| |
