From patchwork Thu Nov 22 04:47:43 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [3.5.yuz, extended, stable] Patch "xhci: fix integer overflow" has been added to staging queue Date: Wed, 21 Nov 2012 18:47:43 -0000 From: Herton Ronaldo Krzesinski X-Patchwork-Id: 200970 Message-Id: <1353559663-1367-1-git-send-email-herton.krzesinski@canonical.com> To: Oliver Neukum Cc: Sarah Sharp , Oliver Neukum , kernel-team@lists.ubuntu.com This is a note to let you know that I have just added a patch titled xhci: fix integer overflow to the linux-3.5.y-queue branch of the 3.5.yuz extended stable tree which can be found at: http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.5.yuz tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Herton ------ >From eb4e70beb09a15ddb148ed26178cde6479990c54 Mon Sep 17 00:00:00 2001 From: Oliver Neukum Date: Wed, 17 Oct 2012 10:16:16 +0200 Subject: [PATCH] xhci: fix integer overflow commit 16b45fdf9c4e82f5d3bc53aa70737650e7c8d5ed upstream. xhci_service_interval_to_ns() returns long long to avoid an overflow. However, the type cast happens too late. The fix is to force ULL from the beginning. This patch should be backported to kernels as old as 3.5, that contain the commit e3567d2c15a7a8e2f992a5f7c7683453ca406d82 "xhci: Add Intel U1/U2 timeout policy." Signed-off-by: Oliver Neukum Signed-off-by: Sarah Sharp Signed-off-by: Herton Ronaldo Krzesinski --- drivers/usb/host/xhci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 1.7.9.5 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 1f9b8a4..5f831c2 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -4020,7 +4020,7 @@ int xhci_update_device(struct usb_hcd *hcd, struct usb_device *udev) static unsigned long long xhci_service_interval_to_ns( struct usb_endpoint_descriptor *desc) { - return (1 << (desc->bInterval - 1)) * 125 * 1000; + return (1ULL << (desc->bInterval - 1)) * 125 * 1000; } static u16 xhci_get_timeout_no_hub_lpm(struct usb_device *udev,