From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B594BC433E0 for ; Tue, 12 Jan 2021 13:54:15 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E8DAB2311B for ; Tue, 12 Jan 2021 13:54:14 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E8DAB2311B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=sakamocchi.jp Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=alsa-devel-bounces@alsa-project.org Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id C97041698; Tue, 12 Jan 2021 14:53:22 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz C97041698 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1610459652; bh=J2IMBoItDuCdZfgJs9+lgg2Cj2pLKMKgW4yJclzWr/M=; h=Date:From:To:Subject:References:In-Reply-To:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=cJHLkbrXk6yNJ54ZHVjjad01fWeIUEU5k4U1WnWstqX8kzPfbqwT8oMwwg+sLxyyP 9+ymT21XY+lx1NU1NTAqd00aZ9nHd+Yxa8XNrBo3M/9nHWTcTQDkkJ0A/F5S6rqeRV 4PoTiaHqDJXrprWqrEbZWrvPDOw/dlrqvOTb0EcE= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id 06011F80249; Tue, 12 Jan 2021 14:53:22 +0100 (CET) Received: by alsa1.perex.cz (Postfix, from userid 50401) id 80572F8025E; Tue, 12 Jan 2021 14:53:20 +0100 (CET) Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 20B42F800EB for ; Tue, 12 Jan 2021 14:53:13 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 20B42F800EB Authentication-Results: alsa1.perex.cz; dkim=pass (2048-bit key) header.d=sakamocchi.jp header.i=@sakamocchi.jp header.b="V3pcoxQU"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="pBe707M/" Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 97DD85C022A; Tue, 12 Jan 2021 08:53:12 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute4.internal (MEProxy); Tue, 12 Jan 2021 08:53:12 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakamocchi.jp; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=fm3; bh=wQHIBUX95kd7FYyqstLD3bY3Dfr sn25GzthoZs7X/Ac=; b=V3pcoxQUY0rNSzsaAGAOloFEq5Kotrg6LPGKrQ19BVF dUVtjFJpcSPZ1FwJUOohF9HssfcrtJqkAN2pH77HJJAfoxlFBA4RPhMBY5f+7u7w qONdTzBh3NC1dQFTuJoO4cXZhoVxIkPmR/LZsK9D9GU/sbFCHmp7T5gtgCTd3KOw IwDm17LPmK6Mn+ATY8HsPuT7WaDBZ+dkYH3hjWiL0E7YSC7WYwNI6X94gQ2SQWsh y/Wad4yjdaX0c/GXAE/Zrrcjfj7UDp/ANAft0O2YCTM2FZT84PRBTupiFop3zrJS pvqLUK6IoMh4JwJSWhOwHSosPHapvcEA2EnMjJgBXLQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=wQHIBU X95kd7FYyqstLD3bY3Dfrsn25GzthoZs7X/Ac=; b=pBe707M//5xjdT8ZRSsjYE LkvmOU+vZuy1W4idgKBGkLkBIuIrhqQRCj3UYm+Kw3oJvJsGeZy7krfjmzeQTIcE HNz10EnTdcO/9PwEDQjGnvFsaTyctl1UfMkgiA2slP+zVDStnB7FmnFsEGL1K7Ua SNDy5bUPGFknT3CwbcGPCr58gCR6rsK5hJxD+iiPXmJ5fhZo7nkZ43DyeyyJK3x3 7mseWsmxZuAbu3Mq6TDmhEEQrqkFVoQmszejCz1XenLhTAEQm7eU2jPZ4oR4BO7I BNQ45yTR2P8tZER9h9b7hIU5PFEPKCYW/TfWniO3qMweYxfKPYFb54j5GoKuvnsQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedukedrtddtgddvhecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpeffhffvuffkfhggtggujgesthdtredttddtvdenucfhrhhomhepvfgrkhgrshhh ihcuufgrkhgrmhhothhouceoohdqthgrkhgrshhhihesshgrkhgrmhhotggthhhirdhjph eqnecuggftrfgrthhtvghrnheplefhueegvdejgfejgfdukeefudetvddtuddtueeivedt tdegteejkedvfeegfefhnecukfhppeduudekrddvgeefrdejkedrheeknecuvehluhhsth gvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepohdqthgrkhgrshhhihes shgrkhgrmhhotggthhhirdhjph X-ME-Proxy: Received: from workstation (y078058.dynamic.ppp.asahi-net.or.jp [118.243.78.58]) by mail.messagingengine.com (Postfix) with ESMTPA id A60C924005D; Tue, 12 Jan 2021 08:53:09 -0500 (EST) Date: Tue, 12 Jan 2021 22:53:06 +0900 From: Takashi Sakamoto To: Geert Uytterhoeven Subject: Re: [PATCH/RFC 1/2] ALSA: fireface: Fix integer overflow in transmit_midi_msg() Message-ID: <20210112135306.GB44140@workstation> Mail-Followup-To: Geert Uytterhoeven , Clemens Ladisch , Jaroslav Kysela , Takashi Iwai , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org References: <20210111130251.361335-1-geert+renesas@glider.be> <20210111130251.361335-2-geert+renesas@glider.be> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210111130251.361335-2-geert+renesas@glider.be> Cc: linux-kernel@vger.kernel.org, alsa-devel@alsa-project.org, Clemens Ladisch , Takashi Iwai X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" Hi, On Mon, Jan 11, 2021 at 02:02:50PM +0100, Geert Uytterhoeven wrote: > As snd_ff.rx_bytes[] is unsigned int, and NSEC_PER_SEC is 1000000000L, > the second multiplication in > > ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250 > > always overflows on 32-bit platforms, truncating the result. Fix this > by precalculating "NSEC_PER_SEC / 31250", which is an integer constant. > > Note that this assumes ff->rx_bytes[port] <= 16777. > > Fixes: 19174295788de77d ("ALSA: fireface: add transaction support") > Signed-off-by: Geert Uytterhoeven > --- > Compile-tested only. > > I don't know the maximum transfer length of MIDI, but given it's an old > standard, I guess it's rather small. If it is larger than 16777, the > constant "8" should be replaced by "8ULL", to force 64-bit arithmetic. > --- > sound/firewire/fireface/ff-transaction.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) The rx_bytes member has value for the length of byte messages to process. The range of value differs depending on Fireface protocol version. For former protocol, the value is equals to or less than SND_FF_MAXIMIM_MIDI_QUADS (= 9). For latter protocol, the value is equals to or less than 3. Anyway, the value should not be larger than 16777 and the calculation can be done without ULL suffix. Reviewd-by: Takashi Sakamoto > diff --git a/sound/firewire/fireface/ff-transaction.c b/sound/firewire/fireface/ff-transaction.c > index 7f82762ccc8c80ba..ee7122c461d46f44 100644 > --- a/sound/firewire/fireface/ff-transaction.c > +++ b/sound/firewire/fireface/ff-transaction.c > @@ -88,7 +88,7 @@ static void transmit_midi_msg(struct snd_ff *ff, unsigned int port) > > /* Set interval to next transaction. */ > ff->next_ktime[port] = ktime_add_ns(ktime_get(), > - ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250); > + ff->rx_bytes[port] * 8 * (NSEC_PER_SEC / 31250)); > > if (quad_count == 1) > tcode = TCODE_WRITE_QUADLET_REQUEST; > -- > 2.25.1 Thanks Takashi Sakamoto From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DBFD5C433DB for ; Tue, 12 Jan 2021 13:54:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9709F23109 for ; Tue, 12 Jan 2021 13:54:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733164AbhALNyT (ORCPT ); Tue, 12 Jan 2021 08:54:19 -0500 Received: from out5-smtp.messagingengine.com ([66.111.4.29]:37337 "EHLO out5-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726043AbhALNyS (ORCPT ); Tue, 12 Jan 2021 08:54:18 -0500 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 97DD85C022A; Tue, 12 Jan 2021 08:53:12 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute4.internal (MEProxy); Tue, 12 Jan 2021 08:53:12 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakamocchi.jp; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=fm3; bh=wQHIBUX95kd7FYyqstLD3bY3Dfr sn25GzthoZs7X/Ac=; b=V3pcoxQUY0rNSzsaAGAOloFEq5Kotrg6LPGKrQ19BVF dUVtjFJpcSPZ1FwJUOohF9HssfcrtJqkAN2pH77HJJAfoxlFBA4RPhMBY5f+7u7w qONdTzBh3NC1dQFTuJoO4cXZhoVxIkPmR/LZsK9D9GU/sbFCHmp7T5gtgCTd3KOw IwDm17LPmK6Mn+ATY8HsPuT7WaDBZ+dkYH3hjWiL0E7YSC7WYwNI6X94gQ2SQWsh y/Wad4yjdaX0c/GXAE/Zrrcjfj7UDp/ANAft0O2YCTM2FZT84PRBTupiFop3zrJS pvqLUK6IoMh4JwJSWhOwHSosPHapvcEA2EnMjJgBXLQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=wQHIBU X95kd7FYyqstLD3bY3Dfrsn25GzthoZs7X/Ac=; b=pBe707M//5xjdT8ZRSsjYE LkvmOU+vZuy1W4idgKBGkLkBIuIrhqQRCj3UYm+Kw3oJvJsGeZy7krfjmzeQTIcE HNz10EnTdcO/9PwEDQjGnvFsaTyctl1UfMkgiA2slP+zVDStnB7FmnFsEGL1K7Ua SNDy5bUPGFknT3CwbcGPCr58gCR6rsK5hJxD+iiPXmJ5fhZo7nkZ43DyeyyJK3x3 7mseWsmxZuAbu3Mq6TDmhEEQrqkFVoQmszejCz1XenLhTAEQm7eU2jPZ4oR4BO7I BNQ45yTR2P8tZER9h9b7hIU5PFEPKCYW/TfWniO3qMweYxfKPYFb54j5GoKuvnsQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedukedrtddtgddvhecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpeffhffvuffkfhggtggujgesthdtredttddtvdenucfhrhhomhepvfgrkhgrshhh ihcuufgrkhgrmhhothhouceoohdqthgrkhgrshhhihesshgrkhgrmhhotggthhhirdhjph eqnecuggftrfgrthhtvghrnheplefhueegvdejgfejgfdukeefudetvddtuddtueeivedt tdegteejkedvfeegfefhnecukfhppeduudekrddvgeefrdejkedrheeknecuvehluhhsth gvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepohdqthgrkhgrshhhihes shgrkhgrmhhotggthhhirdhjph X-ME-Proxy: Received: from workstation (y078058.dynamic.ppp.asahi-net.or.jp [118.243.78.58]) by mail.messagingengine.com (Postfix) with ESMTPA id A60C924005D; Tue, 12 Jan 2021 08:53:09 -0500 (EST) Date: Tue, 12 Jan 2021 22:53:06 +0900 From: Takashi Sakamoto To: Geert Uytterhoeven Cc: Clemens Ladisch , Jaroslav Kysela , Takashi Iwai , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH/RFC 1/2] ALSA: fireface: Fix integer overflow in transmit_midi_msg() Message-ID: <20210112135306.GB44140@workstation> Mail-Followup-To: Geert Uytterhoeven , Clemens Ladisch , Jaroslav Kysela , Takashi Iwai , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org References: <20210111130251.361335-1-geert+renesas@glider.be> <20210111130251.361335-2-geert+renesas@glider.be> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210111130251.361335-2-geert+renesas@glider.be> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, On Mon, Jan 11, 2021 at 02:02:50PM +0100, Geert Uytterhoeven wrote: > As snd_ff.rx_bytes[] is unsigned int, and NSEC_PER_SEC is 1000000000L, > the second multiplication in > > ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250 > > always overflows on 32-bit platforms, truncating the result. Fix this > by precalculating "NSEC_PER_SEC / 31250", which is an integer constant. > > Note that this assumes ff->rx_bytes[port] <= 16777. > > Fixes: 19174295788de77d ("ALSA: fireface: add transaction support") > Signed-off-by: Geert Uytterhoeven > --- > Compile-tested only. > > I don't know the maximum transfer length of MIDI, but given it's an old > standard, I guess it's rather small. If it is larger than 16777, the > constant "8" should be replaced by "8ULL", to force 64-bit arithmetic. > --- > sound/firewire/fireface/ff-transaction.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) The rx_bytes member has value for the length of byte messages to process. The range of value differs depending on Fireface protocol version. For former protocol, the value is equals to or less than SND_FF_MAXIMIM_MIDI_QUADS (= 9). For latter protocol, the value is equals to or less than 3. Anyway, the value should not be larger than 16777 and the calculation can be done without ULL suffix. Reviewd-by: Takashi Sakamoto > diff --git a/sound/firewire/fireface/ff-transaction.c b/sound/firewire/fireface/ff-transaction.c > index 7f82762ccc8c80ba..ee7122c461d46f44 100644 > --- a/sound/firewire/fireface/ff-transaction.c > +++ b/sound/firewire/fireface/ff-transaction.c > @@ -88,7 +88,7 @@ static void transmit_midi_msg(struct snd_ff *ff, unsigned int port) > > /* Set interval to next transaction. */ > ff->next_ktime[port] = ktime_add_ns(ktime_get(), > - ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250); > + ff->rx_bytes[port] * 8 * (NSEC_PER_SEC / 31250)); > > if (quad_count == 1) > tcode = TCODE_WRITE_QUADLET_REQUEST; > -- > 2.25.1 Thanks Takashi Sakamoto