alsa-devel.alsa-project.org archive mirror
 help / color / mirror / Atom feed
From: Dan Carpenter <error27@gmail.com>
To: alsa-devel@alsa-project.org
Cc: Takashi Iwai <tiwai@suse.de>, kernel-janitors@vger.kernel.org
Subject: bug report:  using snd_BUG_ON() instead of WARN_ON()
Date: Thu, 18 Feb 2010 12:19:36 +0300	[thread overview]
Message-ID: <20100218091936.GA5621@bicker> (raw)

Smatch found a couple places try use the return value for snd_BUG_ON() 
without realizing it's always zero or that it can be defined away entirely
under certain configs.

sound/core/info_oss.c
    46          if (snd_BUG_ON(dev < 0 || dev >= SNDRV_OSS_INFO_DEV_COUNT))
    47                  return -ENXIO;
    48          if (snd_BUG_ON(num < 0 || num >= SNDRV_CARDS))
    49                  return -ENXIO;

sound/drivers/opl3/opl3_midi.c +652 snd_opl3_kill_voice(34) warn: buffer overflow 'opl3->voices' 18 <= 20

	opl3_midi.c checks the range with snd_BUG_ON() and then adds 3 so 
	it possibly goes out of bounds.  I'm not sure the situation there.

sound/core/seq/seq_midi.c +403 snd_seq_midisynth_register_port(126) error: buffer overflow 'client->ports_per_device' 8 <= 8
sound/core/seq/seq_midi.c +404 snd_seq_midisynth_register_port(127) error: buffer overflow 'client->ports' 8 <= 8
sound/core/info_oss.c +52 snd_oss_info_register(10) error: buffer overflow 'snd_sndstat_strings[num]' 6 <= 6
sound/core/info_oss.c +52 snd_oss_info_register(10) error: buffer overflow 'snd_sndstat_strings' 32 <= 32
sound/core/info_oss.c +63 snd_oss_info_register(21) error: buffer overflow 'snd_sndstat_strings[num]' 6 <= 6
sound/core/info_oss.c +63 snd_oss_info_register(21) error: buffer overflow 'snd_sndstat_strings' 32 <= 32
sound/pci/cs46xx/dsp_spos_scb_lib.c +1497 cs46xx_dsp_destroy_pcm_channel(28) error: buffer overflow 'ins->src_scb_slots' 14 <= 14

regards,
dan carpenter

             reply	other threads:[~2010-02-18  9:20 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-02-18  9:19 Dan Carpenter [this message]
2010-02-19 17:41 ` bug report: using snd_BUG_ON() instead of WARN_ON() Clemens Ladisch
2010-02-19 19:53   ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20100218091936.GA5621@bicker \
    --to=error27@gmail.com \
    --cc=alsa-devel@alsa-project.org \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=tiwai@suse.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).