From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Fri, 21 Dec 2018 09:06:58 +0000 Subject: [PATCH 4/4] ALSA: compress: prevent potential divide by zero bugs Message-Id: <20181221090658.GD2735@kadam> List-Id: References: <20181221090442.GA2735@kadam> In-Reply-To: <20181221090442.GA2735@kadam> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Patrick Lai , Srinivas Kandagatla Cc: alsa-devel@alsa-project.org, Banajit Goswami , kernel-janitors@vger.kernel.org, Takashi Iwai , Liam Girdwood , Vinod Koul , Mark Brown The problem is seen in the q6asm_dai_compr_set_params() function: ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys, (prtd->pcm_size / prtd->periods), ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ prtd->periods); In this code prtd->pcm_size is the buffer_size and prtd->periods comes from params->buffer.fragments. If we allow the number of fragments to be zero then it results in a divide by zero bug. One possible fix would be to use prtd->pcm_count directly instead of using the division to re-calculate it. But I decided that it doesn't really make sense to allow zero fragments. Signed-off-by: Dan Carpenter --- I am not very sure of this patch. Please review it extra carefully because it is an API change. sound/core/compress_offload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index a5b09e75e787..f7d2b373da0a 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -541,7 +541,8 @@ static int snd_compress_check_input(struct snd_compr_params *params) { /* first let's check the buffer parameter's */ if (params->buffer.fragment_size = 0 || - params->buffer.fragments > INT_MAX / params->buffer.fragment_size) + params->buffer.fragments > INT_MAX / params->buffer.fragment_size || + params->buffer.fragments = 0) return -EINVAL; /* now codec parameters */ -- 2.17.1