All of lore.kernel.org
 help / color / mirror / Atom feed
* [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29  8:14 ` Dan Carpenter
  0 siblings, 0 replies; 10+ messages in thread
From: Dan Carpenter @ 2013-11-29  8:14 UTC (permalink / raw)
  To: Clemens Ladisch
  Cc: Jaroslav Kysela, Takashi Iwai, alsa-devel, kernel-janitors

The array limits are supposed to be in units of u32 instead of in bytes.
The current code has a potential array overflow.

Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
index 57bcd31fcc12..c0aa64941cee 100644
--- a/sound/firewire/dice.c
+++ b/sound/firewire/dice.c
@@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
 
 	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
 		return;
-	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
+	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
 	for (stream = 0; stream < tx_rx_header.number; ++stream) {
 		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
 				       stream * tx_rx_header.size,
@@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
 
 	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
 		return;
-	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
+	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
 	for (stream = 0; stream < tx_rx_header.number; ++stream) {
 		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
 				       stream * tx_rx_header.size,

^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29  8:14 ` Dan Carpenter
  0 siblings, 0 replies; 10+ messages in thread
From: Dan Carpenter @ 2013-11-29  8:14 UTC (permalink / raw)
  To: Clemens Ladisch
  Cc: Jaroslav Kysela, Takashi Iwai, alsa-devel, kernel-janitors

The array limits are supposed to be in units of u32 instead of in bytes.
The current code has a potential array overflow.

Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
index 57bcd31fcc12..c0aa64941cee 100644
--- a/sound/firewire/dice.c
+++ b/sound/firewire/dice.c
@@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
 
 	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
 		return;
-	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
+	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
 	for (stream = 0; stream < tx_rx_header.number; ++stream) {
 		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
 				       stream * tx_rx_header.size,
@@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
 
 	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
 		return;
-	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
+	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
 	for (stream = 0; stream < tx_rx_header.number; ++stream) {
 		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
 				       stream * tx_rx_header.size,

^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
  2013-11-29  8:14 ` Dan Carpenter
@ 2013-11-29  9:11   ` Clemens Ladisch
  -1 siblings, 0 replies; 10+ messages in thread
From: Clemens Ladisch @ 2013-11-29  9:11 UTC (permalink / raw)
  To: Dan Carpenter; +Cc: Jaroslav Kysela, Takashi Iwai, alsa-devel, kernel-janitors

Dan Carpenter wrote:
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
>
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Acked-by: Clemens Ladisch <clemens@ladisch.de>

> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
>  				       stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
>  				       stream * tx_rx_header.size,

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29  9:11   ` Clemens Ladisch
  0 siblings, 0 replies; 10+ messages in thread
From: Clemens Ladisch @ 2013-11-29  9:11 UTC (permalink / raw)
  To: Dan Carpenter; +Cc: Jaroslav Kysela, Takashi Iwai, alsa-devel, kernel-janitors

Dan Carpenter wrote:
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
>
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Acked-by: Clemens Ladisch <clemens@ladisch.de>

> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
>  				       stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
>  				       stream * tx_rx_header.size,

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
  2013-11-29  8:14 ` Dan Carpenter
@ 2013-11-29  9:24   ` Takashi Iwai
  -1 siblings, 0 replies; 10+ messages in thread
From: Takashi Iwai @ 2013-11-29  9:24 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Clemens Ladisch, Jaroslav Kysela, alsa-devel, kernel-janitors

At Fri, 29 Nov 2013 11:14:09 +0300,
Dan Carpenter wrote:
> 
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
> 
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Thanks, applied.


Takashi

> 
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>  
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
>  				       stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>  
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
>  				       stream * tx_rx_header.size,
> 

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29  9:24   ` Takashi Iwai
  0 siblings, 0 replies; 10+ messages in thread
From: Takashi Iwai @ 2013-11-29  9:24 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Clemens Ladisch, Jaroslav Kysela, alsa-devel, kernel-janitors

At Fri, 29 Nov 2013 11:14:09 +0300,
Dan Carpenter wrote:
> 
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
> 
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Thanks, applied.


Takashi

> 
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>  
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
>  				       stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>  
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
>  				       stream * tx_rx_header.size,
> 

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
  2013-11-29  8:14 ` Dan Carpenter
@ 2013-11-29  9:48   ` walter harms
  -1 siblings, 0 replies; 10+ messages in thread
From: walter harms @ 2013-11-29  9:48 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Clemens Ladisch, Jaroslav Kysela, Takashi Iwai, alsa-devel,
	kernel-janitors



Am 29.11.2013 09:14, schrieb Dan Carpenter:
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
> 
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>  
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);

it is a bit late but ...

sizeof(buf.tx) / 4  looks like ARRAY_SIZE(buf.tx)

If yes i suggest ARRAY_SIZE() because it gets rid of the "magic" 4.

re,
 wh


>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
>  				       stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>  
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
>  				       stream * tx_rx_header.size,
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29  9:48   ` walter harms
  0 siblings, 0 replies; 10+ messages in thread
From: walter harms @ 2013-11-29  9:48 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Clemens Ladisch, Jaroslav Kysela, Takashi Iwai, alsa-devel,
	kernel-janitors



Am 29.11.2013 09:14, schrieb Dan Carpenter:
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
> 
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>  
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);

it is a bit late but ...

sizeof(buf.tx) / 4  looks like ARRAY_SIZE(buf.tx)

If yes i suggest ARRAY_SIZE() because it gets rid of the "magic" 4.

re,
 wh


>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
>  				       stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>  
>  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
>  		return;
> -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
>  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
>  		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
>  				       stream * tx_rx_header.size,
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
  2013-11-29  9:48   ` walter harms
@ 2013-11-29  9:55     ` Takashi Iwai
  -1 siblings, 0 replies; 10+ messages in thread
From: Takashi Iwai @ 2013-11-29  9:55 UTC (permalink / raw)
  To: wharms
  Cc: Dan Carpenter, Clemens Ladisch, Jaroslav Kysela, alsa-devel,
	kernel-janitors

At Fri, 29 Nov 2013 10:48:28 +0100,
walter harms wrote:
> 
> 
> 
> Am 29.11.2013 09:14, schrieb Dan Carpenter:
> > The array limits are supposed to be in units of u32 instead of in bytes.
> > The current code has a potential array overflow.
> > 
> > Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > 
> > diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> > index 57bcd31fcc12..c0aa64941cee 100644
> > --- a/sound/firewire/dice.c
> > +++ b/sound/firewire/dice.c
> > @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
> >  
> >  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> >  		return;
> > -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> > +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
> 
> it is a bit late but ...
> 
> sizeof(buf.tx) / 4  looks like ARRAY_SIZE(buf.tx)

Not in this case :)
I thought of it at first, too, but understood it after reading the
code.


Takashi

> 
> If yes i suggest ARRAY_SIZE() because it gets rid of the "magic" 4.
> 
> re,
>  wh
> 
> 
> >  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
> >  		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> >  				       stream * tx_rx_header.size,
> > @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
> >  
> >  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> >  		return;
> > -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> > +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> >  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
> >  		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> >  				       stream * tx_rx_header.size,
> > --
> > To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> > 
> 

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29  9:55     ` Takashi Iwai
  0 siblings, 0 replies; 10+ messages in thread
From: Takashi Iwai @ 2013-11-29  9:55 UTC (permalink / raw)
  To: wharms
  Cc: Dan Carpenter, Clemens Ladisch, Jaroslav Kysela, alsa-devel,
	kernel-janitors

At Fri, 29 Nov 2013 10:48:28 +0100,
walter harms wrote:
> 
> 
> 
> Am 29.11.2013 09:14, schrieb Dan Carpenter:
> > The array limits are supposed to be in units of u32 instead of in bytes.
> > The current code has a potential array overflow.
> > 
> > Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > 
> > diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> > index 57bcd31fcc12..c0aa64941cee 100644
> > --- a/sound/firewire/dice.c
> > +++ b/sound/firewire/dice.c
> > @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
> >  
> >  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> >  		return;
> > -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> > +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
> 
> it is a bit late but ...
> 
> sizeof(buf.tx) / 4  looks like ARRAY_SIZE(buf.tx)

Not in this case :)
I thought of it at first, too, but understood it after reading the
code.


Takashi

> 
> If yes i suggest ARRAY_SIZE() because it gets rid of the "magic" 4.
> 
> re,
>  wh
> 
> 
> >  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
> >  		if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> >  				       stream * tx_rx_header.size,
> > @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
> >  
> >  	if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> >  		return;
> > -	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> > +	quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> >  	for (stream = 0; stream < tx_rx_header.number; ++stream) {
> >  		if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> >  				       stream * tx_rx_header.size,
> > --
> > To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> > 
> 

^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2013-11-29  9:55 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-29  8:14 [patch] ALSA: dice: fix array limits in dice_proc_read() Dan Carpenter
2013-11-29  8:14 ` Dan Carpenter
2013-11-29  9:11 ` Clemens Ladisch
2013-11-29  9:11   ` Clemens Ladisch
2013-11-29  9:24 ` Takashi Iwai
2013-11-29  9:24   ` Takashi Iwai
2013-11-29  9:48 ` walter harms
2013-11-29  9:48   ` walter harms
2013-11-29  9:55   ` Takashi Iwai
2013-11-29  9:55     ` Takashi Iwai

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.