From mboxrd@z Thu Jan 1 00:00:00 1970 From: Takashi Iwai Subject: Re: [PATCH] ALSA: firewire-lib: fix buffer-over-run when detecting packet discontinuity Date: Wed, 27 May 2015 17:46:33 +0200 Message-ID: References: <1432738979-13562-1-git-send-email-o-takashi@sakamocchi.jp> Mime-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx2.suse.de (cantor2.suse.de [195.135.220.15]) by alsa0.perex.cz (Postfix) with ESMTP id 7FFD6265ACA for ; Wed, 27 May 2015 17:46:36 +0200 (CEST) In-Reply-To: <1432738979-13562-1-git-send-email-o-takashi@sakamocchi.jp> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org To: Takashi Sakamoto Cc: alsa-devel@alsa-project.org, clemens@ladisch.de, dan.carpenter@oracle.com, ffado-devel@lists.sf.net List-Id: alsa-devel@alsa-project.org At Thu, 28 May 2015 00:02:59 +0900, Takashi Sakamoto wrote: > > When detecting packet discontinuity, handle_in_packet() returns minus value > and this value is assigned to unsigned int variable, then the variable has > huge value. As a result, the variable causes buffer-over-run in > handle_out_packet(). This brings invalid page request and system hangup. > > This commit fixes the bug to add a new argument into handle_in_packet() > and the number of handled data blocks is assignd to it. The function > return value is just used to check error. > > I also considered to change the type of local variable to 'int' in > in_stream_callback(). This idea is based on type-conversion in C standard, > while it may cause future problems when adding more works. Thus, I dropped > this idea. > > Fixes: 6fc6b9ce41c6('ALSA: firewire-lib: pass the number of data blocks in incoming packets to outgoing packets') > Reported-by: Dan Carpenter > Signed-off-by: Takashi Sakamoto Applied, thanks. Takashi > --- > sound/firewire/amdtp.c | 32 ++++++++++++++++---------------- > 1 file changed, 16 insertions(+), 16 deletions(-) > > diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c > index 2b3e8b1..7bb988f 100644 > --- a/sound/firewire/amdtp.c > +++ b/sound/firewire/amdtp.c > @@ -688,10 +688,10 @@ static int handle_out_packet(struct amdtp_stream *s, unsigned int data_blocks, > } > > static int handle_in_packet(struct amdtp_stream *s, > - unsigned int payload_quadlets, __be32 *buffer) > + unsigned int payload_quadlets, __be32 *buffer, > + unsigned int *data_blocks) > { > u32 cip_header[2]; > - unsigned int data_blocks; > unsigned int data_block_quadlets, data_block_counter, dbc_interval; > struct snd_pcm_substream *pcm = NULL; > bool lost; > @@ -709,7 +709,7 @@ static int handle_in_packet(struct amdtp_stream *s, > dev_info_ratelimited(&s->unit->device, > "Invalid CIP header for AMDTP: %08X:%08X\n", > cip_header[0], cip_header[1]); > - data_blocks = 0; > + *data_blocks = 0; > goto end; > } > > @@ -717,7 +717,7 @@ static int handle_in_packet(struct amdtp_stream *s, > if (payload_quadlets < 3 || > ((cip_header[1] & CIP_FDF_MASK) == > (AMDTP_FDF_NO_DATA << CIP_FDF_SHIFT))) { > - data_blocks = 0; > + *data_blocks = 0; > } else { > data_block_quadlets = > (cip_header[0] & CIP_DBS_MASK) >> CIP_DBS_SHIFT; > @@ -731,12 +731,12 @@ static int handle_in_packet(struct amdtp_stream *s, > if (s->flags & CIP_WRONG_DBS) > data_block_quadlets = s->data_block_quadlets; > > - data_blocks = (payload_quadlets - 2) / data_block_quadlets; > + *data_blocks = (payload_quadlets - 2) / data_block_quadlets; > } > > /* Check data block counter continuity */ > data_block_counter = cip_header[0] & CIP_DBC_MASK; > - if (data_blocks == 0 && (s->flags & CIP_EMPTY_HAS_WRONG_DBC) && > + if (*data_blocks == 0 && (s->flags & CIP_EMPTY_HAS_WRONG_DBC) && > s->data_block_counter != UINT_MAX) > data_block_counter = s->data_block_counter; > > @@ -746,10 +746,10 @@ static int handle_in_packet(struct amdtp_stream *s, > } else if (!(s->flags & CIP_DBC_IS_END_EVENT)) { > lost = data_block_counter != s->data_block_counter; > } else { > - if ((data_blocks > 0) && (s->tx_dbc_interval > 0)) > + if ((*data_blocks > 0) && (s->tx_dbc_interval > 0)) > dbc_interval = s->tx_dbc_interval; > else > - dbc_interval = data_blocks; > + dbc_interval = *data_blocks; > > lost = data_block_counter != > ((s->data_block_counter + dbc_interval) & 0xff); > @@ -762,30 +762,30 @@ static int handle_in_packet(struct amdtp_stream *s, > return -EIO; > } > > - if (data_blocks > 0) { > + if (*data_blocks > 0) { > buffer += 2; > > pcm = ACCESS_ONCE(s->pcm); > if (pcm) > - s->transfer_samples(s, pcm, buffer, data_blocks); > + s->transfer_samples(s, pcm, buffer, *data_blocks); > > if (s->midi_ports) > - read_midi_messages(s, buffer, data_blocks); > + read_midi_messages(s, buffer, *data_blocks); > } > > if (s->flags & CIP_DBC_IS_END_EVENT) > s->data_block_counter = data_block_counter; > else > s->data_block_counter = > - (data_block_counter + data_blocks) & 0xff; > + (data_block_counter + *data_blocks) & 0xff; > end: > if (queue_in_packet(s) < 0) > return -EIO; > > if (pcm) > - update_pcm_pointers(s, pcm, data_blocks); > + update_pcm_pointers(s, pcm, *data_blocks); > > - return data_blocks; > + return 0; > } > > static void out_stream_callback(struct fw_iso_context *context, u32 cycle, > @@ -853,8 +853,8 @@ static void in_stream_callback(struct fw_iso_context *context, u32 cycle, > break; > } > > - data_blocks = handle_in_packet(s, payload_quadlets, buffer); > - if (data_blocks < 0) { > + if (handle_in_packet(s, payload_quadlets, buffer, > + &data_blocks) < 0) { > s->packet_index = -1; > break; > } > -- > 2.1.4 >