From 01f23c5f1526f5b6ff744887aa511b9e69d4401b Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Thu, 29 Jun 2023 12:09:00 -0700 Subject: [PATCH] usb: ch9: Replace bmSublinkSpeedAttr 1-element array with flexible array Since commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC"), UBSAN_BOUNDS no longer pretends 1-element arrays are unbounded. Walking bmSublinkSpeedAttr will trigger a warning, so make it a proper flexible array. Add a union to keep the struct size identical for userspace in case anything was depending on the old size. False positive warning was: UBSAN: array-index-out-of-bounds in drivers/usb/host/xhci-hub.c:231:31 index 1 is out of range for type '__le32 [1]' for this line of code: ssp_cap->bmSublinkSpeedAttr[offset++] = cpu_to_le32(attr); Reported-by: Borislav Petkov Closes: https://lore.kernel.org/lkml/2023062945-fencing-pebble-0411@gregkh/ Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/lkml/9a8e34ad-8a8b-3830-4878-3c2c82e69dd9@alu.unizg.hr/ Cc: Greg Kroah-Hartman Cc: "Gustavo A. R. Silva" Tested-by: "Borislav Petkov (AMD)" Tested-by: Mirsad Todorovac Reviewed-by: "Gustavo A. R. Silva" Link: https://lore.kernel.org/r/20230629190900.never.787-kees@kernel.org Signed-off-by: Kees Cook --- include/uapi/linux/usb/ch9.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h index b17e3a21b15f..3ff98c7ba7e3 100644 --- a/include/uapi/linux/usb/ch9.h +++ b/include/uapi/linux/usb/ch9.h @@ -981,7 +981,11 @@ struct usb_ssp_cap_descriptor { #define USB_SSP_MIN_RX_LANE_COUNT (0xf << 8) #define USB_SSP_MIN_TX_LANE_COUNT (0xf << 12) __le16 wReserved; - __le32 bmSublinkSpeedAttr[1]; /* list of sublink speed attrib entries */ + union { + __le32 legacy_padding; + /* list of sublink speed attrib entries */ + __DECLARE_FLEX_ARRAY(__le32, bmSublinkSpeedAttr); + }; #define USB_SSP_SUBLINK_SPEED_SSID (0xf) /* sublink speed ID */ #define USB_SSP_SUBLINK_SPEED_LSE (0x3 << 4) /* Lanespeed exponent */ #define USB_SSP_SUBLINK_SPEED_LSE_BPS 0 -- 2.20.1