* [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29 8:14 ` Dan Carpenter
0 siblings, 0 replies; 10+ messages in thread
From: Dan Carpenter @ 2013-11-29 8:14 UTC (permalink / raw)
To: Clemens Ladisch
Cc: Jaroslav Kysela, Takashi Iwai, alsa-devel, kernel-janitors
The array limits are supposed to be in units of u32 instead of in bytes.
The current code has a potential array overflow.
Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
index 57bcd31fcc12..c0aa64941cee 100644
--- a/sound/firewire/dice.c
+++ b/sound/firewire/dice.c
@@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
return;
- quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
+ quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
for (stream = 0; stream < tx_rx_header.number; ++stream) {
if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
stream * tx_rx_header.size,
@@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
return;
- quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
+ quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
for (stream = 0; stream < tx_rx_header.number; ++stream) {
if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
stream * tx_rx_header.size,
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
2013-11-29 8:14 ` Dan Carpenter
@ 2013-11-29 9:11 ` Clemens Ladisch
-1 siblings, 0 replies; 10+ messages in thread
From: Clemens Ladisch @ 2013-11-29 9:11 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Jaroslav Kysela, Takashi Iwai, alsa-devel, kernel-janitors
Dan Carpenter wrote:
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
>
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Clemens Ladisch <clemens@ladisch.de>
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> stream * tx_rx_header.size,
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29 9:11 ` Clemens Ladisch
0 siblings, 0 replies; 10+ messages in thread
From: Clemens Ladisch @ 2013-11-29 9:11 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Jaroslav Kysela, Takashi Iwai, alsa-devel, kernel-janitors
Dan Carpenter wrote:
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
>
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Clemens Ladisch <clemens@ladisch.de>
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> stream * tx_rx_header.size,
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
2013-11-29 8:14 ` Dan Carpenter
@ 2013-11-29 9:24 ` Takashi Iwai
-1 siblings, 0 replies; 10+ messages in thread
From: Takashi Iwai @ 2013-11-29 9:24 UTC (permalink / raw)
To: Dan Carpenter
Cc: Clemens Ladisch, Jaroslav Kysela, alsa-devel, kernel-janitors
At Fri, 29 Nov 2013 11:14:09 +0300,
Dan Carpenter wrote:
>
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
>
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks, applied.
Takashi
>
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> stream * tx_rx_header.size,
>
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29 9:24 ` Takashi Iwai
0 siblings, 0 replies; 10+ messages in thread
From: Takashi Iwai @ 2013-11-29 9:24 UTC (permalink / raw)
To: Dan Carpenter
Cc: Clemens Ladisch, Jaroslav Kysela, alsa-devel, kernel-janitors
At Fri, 29 Nov 2013 11:14:09 +0300,
Dan Carpenter wrote:
>
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
>
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks, applied.
Takashi
>
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> stream * tx_rx_header.size,
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
2013-11-29 8:14 ` Dan Carpenter
@ 2013-11-29 9:48 ` walter harms
-1 siblings, 0 replies; 10+ messages in thread
From: walter harms @ 2013-11-29 9:48 UTC (permalink / raw)
To: Dan Carpenter
Cc: Clemens Ladisch, Jaroslav Kysela, Takashi Iwai, alsa-devel,
kernel-janitors
Am 29.11.2013 09:14, schrieb Dan Carpenter:
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
>
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
it is a bit late but ...
sizeof(buf.tx) / 4 looks like ARRAY_SIZE(buf.tx)
If yes i suggest ARRAY_SIZE() because it gets rid of the "magic" 4.
re,
wh
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> stream * tx_rx_header.size,
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29 9:48 ` walter harms
0 siblings, 0 replies; 10+ messages in thread
From: walter harms @ 2013-11-29 9:48 UTC (permalink / raw)
To: Dan Carpenter
Cc: Clemens Ladisch, Jaroslav Kysela, Takashi Iwai, alsa-devel,
kernel-janitors
Am 29.11.2013 09:14, schrieb Dan Carpenter:
> The array limits are supposed to be in units of u32 instead of in bytes.
> The current code has a potential array overflow.
>
> Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> index 57bcd31fcc12..c0aa64941cee 100644
> --- a/sound/firewire/dice.c
> +++ b/sound/firewire/dice.c
> @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
it is a bit late but ...
sizeof(buf.tx) / 4 looks like ARRAY_SIZE(buf.tx)
If yes i suggest ARRAY_SIZE() because it gets rid of the "magic" 4.
re,
wh
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> stream * tx_rx_header.size,
> @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
>
> if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> return;
> - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> for (stream = 0; stream < tx_rx_header.number; ++stream) {
> if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> stream * tx_rx_header.size,
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
2013-11-29 9:48 ` walter harms
@ 2013-11-29 9:55 ` Takashi Iwai
-1 siblings, 0 replies; 10+ messages in thread
From: Takashi Iwai @ 2013-11-29 9:55 UTC (permalink / raw)
To: wharms
Cc: Dan Carpenter, Clemens Ladisch, Jaroslav Kysela, alsa-devel,
kernel-janitors
At Fri, 29 Nov 2013 10:48:28 +0100,
walter harms wrote:
>
>
>
> Am 29.11.2013 09:14, schrieb Dan Carpenter:
> > The array limits are supposed to be in units of u32 instead of in bytes.
> > The current code has a potential array overflow.
> >
> > Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> >
> > diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> > index 57bcd31fcc12..c0aa64941cee 100644
> > --- a/sound/firewire/dice.c
> > +++ b/sound/firewire/dice.c
> > @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
> >
> > if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> > return;
> > - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> > + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
>
> it is a bit late but ...
>
> sizeof(buf.tx) / 4 looks like ARRAY_SIZE(buf.tx)
Not in this case :)
I thought of it at first, too, but understood it after reading the
code.
Takashi
>
> If yes i suggest ARRAY_SIZE() because it gets rid of the "magic" 4.
>
> re,
> wh
>
>
> > for (stream = 0; stream < tx_rx_header.number; ++stream) {
> > if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> > stream * tx_rx_header.size,
> > @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
> >
> > if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> > return;
> > - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> > + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> > for (stream = 0; stream < tx_rx_header.number; ++stream) {
> > if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> > stream * tx_rx_header.size,
> > --
> > To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
> >
>
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [patch] ALSA: dice: fix array limits in dice_proc_read()
@ 2013-11-29 9:55 ` Takashi Iwai
0 siblings, 0 replies; 10+ messages in thread
From: Takashi Iwai @ 2013-11-29 9:55 UTC (permalink / raw)
To: wharms
Cc: Dan Carpenter, Clemens Ladisch, Jaroslav Kysela, alsa-devel,
kernel-janitors
At Fri, 29 Nov 2013 10:48:28 +0100,
walter harms wrote:
>
>
>
> Am 29.11.2013 09:14, schrieb Dan Carpenter:
> > The array limits are supposed to be in units of u32 instead of in bytes.
> > The current code has a potential array overflow.
> >
> > Fixes: c614475b0ea9 ('ALSA: dice: add a proc file to show device information')
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> >
> > diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
> > index 57bcd31fcc12..c0aa64941cee 100644
> > --- a/sound/firewire/dice.c
> > +++ b/sound/firewire/dice.c
> > @@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
> >
> > if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
> > return;
> > - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
> > + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
>
> it is a bit late but ...
>
> sizeof(buf.tx) / 4 looks like ARRAY_SIZE(buf.tx)
Not in this case :)
I thought of it at first, too, but understood it after reading the
code.
Takashi
>
> If yes i suggest ARRAY_SIZE() because it gets rid of the "magic" 4.
>
> re,
> wh
>
>
> > for (stream = 0; stream < tx_rx_header.number; ++stream) {
> > if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
> > stream * tx_rx_header.size,
> > @@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
> >
> > if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
> > return;
> > - quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
> > + quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
> > for (stream = 0; stream < tx_rx_header.number; ++stream) {
> > if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
> > stream * tx_rx_header.size,
> > --
> > To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
> >
>
^ permalink raw reply [flat|nested] 10+ messages in thread