From: Dan Carpenter <dan.carpenter@oracle.com>
To: pierre-louis.bossart@linux.intel.com
Cc: alsa-devel@alsa-project.org
Subject: [bug report] ASoC: topology: fix endianness issues
Date: Wed, 9 Dec 2020 09:53:44 +0300 [thread overview]
Message-ID: <X9B0eDcKy+9B6kZl@mwanda> (raw)
[ This bug is way older than your patch but you might know the answer.
-dan ]
Hello Pierre-Louis Bossart,
The patch 5aebe7c7f9c2: "ASoC: topology: fix endianness issues" from
Apr 4, 2019, leads to the following static checker warning:
sound/soc/soc-topology.c:903 soc_tplg_denum_create_values()
warn: potential pointer math issue ('se->dobj.control.dvalues' is a 64 bit pointer)
sound/soc/soc-topology.c
887 static int soc_tplg_denum_create_values(struct soc_tplg *tplg, struct soc_enum *se,
888 struct snd_soc_tplg_enum_control *ec)
889 {
890 int i;
891
892 if (le32_to_cpu(ec->items) > sizeof(*ec->values))
The warning is from this line where Smatch starts to think that
"ec->items" is the number of bytes, but later in the function we treat
it was the number of elements.
I do think probably this should be if:
if (le32_to_cpu(ec->items) > ARRAY_SIZE(ec->values))
return -EINVAL;
The ec->values[] is an array of u32:
__le32 values[SND_SOC_TPLG_NUM_TEXTS * SNDRV_CTL_ELEM_ID_NAME_MAXLEN / 4];
so this code will return -EINVAL for anything larger than 4. Changing
it to ARRAY_SIZE() would raise the limit to 176.
893 return -EINVAL;
894
895 se->dobj.control.dvalues = devm_kzalloc(tplg->dev, le32_to_cpu(ec->items) *
896 sizeof(u32),
897 GFP_KERNEL);
898 if (!se->dobj.control.dvalues)
899 return -ENOMEM;
900
901 /* convert from little-endian */
902 for (i = 0; i < le32_to_cpu(ec->items); i++) {
903 se->dobj.control.dvalues[i] = le32_to_cpu(ec->values[i]);
904 }
905
906 return 0;
907 }
regards,
dan carpenter
next reply other threads:[~2020-12-09 6:56 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-09 6:53 Dan Carpenter [this message]
2020-12-09 14:30 ` [bug report] ASoC: topology: fix endianness issues Pierre-Louis Bossart
2020-12-09 16:19 ` Amadeusz Sławiński
2020-12-09 17:32 ` Ranjani Sridharan
2020-12-09 17:41 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=X9B0eDcKy+9B6kZl@mwanda \
--to=dan.carpenter@oracle.com \
--cc=alsa-devel@alsa-project.org \
--cc=pierre-louis.bossart@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox