[patch] [ALSA] hwdep: silence integer overflow warning

[patch] [ALSA] hwdep: silence integer overflow warning

[Dan Carpenter]

Smatch complains that if device is INT_MAX then device + 1 can
overflow.  It just means we would have an annoying loop while we
check all the devices from -2147483648 to SNDRV_MINOR_HWDEPS.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index c7ceb28..edfdf6d 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -273,7 +273,14 @@ static int snd_hwdep_control_ioctl(struct snd_card *card,
 			if (get_user(device, (int __user *)arg))
 				return -EFAULT;
 			mutex_lock(&register_mutex);
-			device = device < 0 ? 0 : device + 1;
+
+			if (device < 0)
+				device = 0;
+			else if (device > SNDRV_MINOR_HWDEPS)
+				device = SNDRV_MINOR_HWDEPS;
+			else
+				device++;
+
 			while (device < SNDRV_MINOR_HWDEPS) {
 				if (snd_hwdep_search(card, device))
 					break;

Re: [patch] [ALSA] hwdep: silence integer overflow warning

[walter harms]

Am 20.10.2011 08:09, schrieb Dan Carpenter:
> Smatch complains that if device is INT_MAX then device + 1 can
> overflow.  It just means we would have an annoying loop while we
> check all the devices from -2147483648 to SNDRV_MINOR_HWDEPS.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
> index c7ceb28..edfdf6d 100644
> --- a/sound/core/hwdep.c
> +++ b/sound/core/hwdep.c
> @@ -273,7 +273,14 @@ static int snd_hwdep_control_ioctl(struct snd_card *card,
>  			if (get_user(device, (int __user *)arg))
>  				return -EFAULT;
>  			mutex_lock(&register_mutex);
> -			device = device < 0 ? 0 : device + 1;
> +
> +			if (device < 0)
> +				device = 0;
> +			else if (device > SNDRV_MINOR_HWDEPS)
> +				device = SNDRV_MINOR_HWDEPS;
> +			else
> +				device++;
> +
>  			while (device < SNDRV_MINOR_HWDEPS) {
>  				if (snd_hwdep_search(card, device))
>  					break;

I am not sure how SNDRV_MINOR_HWDEPS is used further but:
		else if (device < SNDRV_MINOR_HWDEPS)
				device++;
	        else
	              device = SNDRV_MINOR_HWDEPS;

that cuts the corner case device = SNDRV_MINOR_HWDEPS.

re,
 wh



> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> 

Re: [patch] [ALSA] hwdep: silence integer overflow warning

[Dan Carpenter]

On Thu, Oct 20, 2011 at 09:39:23AM +0200, walter harms wrote:
> I am not sure how SNDRV_MINOR_HWDEPS is used further

Either device = SNDRV_MINOR_HWDEPS or device = SNDRV_MINOR_HWDEPS + 1
are fine (equivalent) but it's a fair point.  Your version is nicer.

I'll redo the patch.

regards,
dan carpenter

Re: [patch] [ALSA] hwdep: silence integer overflow warning

[walter harms]

Am 28.10.2011 08:45, schrieb Dan Carpenter:
> On Thu, Oct 20, 2011 at 09:39:23AM +0200, walter harms wrote:
>> I am not sure how SNDRV_MINOR_HWDEPS is used further
> 
> Either device = SNDRV_MINOR_HWDEPS or device = SNDRV_MINOR_HWDEPS + 1
> are fine (equivalent) but it's a fair point.  Your version is nicer.
> 
> I'll redo the patch.
> 

An other question is:
Should the user be informed that the device is modified ?
The Problem i see is that a user parameter is silently modified
and buggy code will come through.

re,
 wh

Re: [patch] [ALSA] hwdep: silence integer overflow warning

[Dan Carpenter]

On Fri, Oct 28, 2011 at 09:33:11AM +0200, walter harms wrote:
> 
> 
> Am 28.10.2011 08:45, schrieb Dan Carpenter:
> > On Thu, Oct 20, 2011 at 09:39:23AM +0200, walter harms wrote:
> >> I am not sure how SNDRV_MINOR_HWDEPS is used further
> > 
> > Either device = SNDRV_MINOR_HWDEPS or device = SNDRV_MINOR_HWDEPS + 1
> > are fine (equivalent) but it's a fair point.  Your version is nicer.
> > 
> > I'll redo the patch.
> > 
> 
> An other question is:
> Should the user be informed that the device is modified ?
> The Problem i see is that a user parameter is silently modified
> and buggy code will come through.

That would be an API change.

This is cut and pasted code, and we've had this exact discussion
before for sound/core/rawmidi.c a year ago.  You were involved in
the discussion too.  :P
http://marc.info/?l=kernel-janitors&m\x128401699203676&w=2

regards,
dan carpenter

[patch v2] [ALSA] hwdep: silence integer overflow warning

[Dan Carpenter]

Smatch complains that if device is INT_MAX then device + 1 can
overflow.  It just means we would have an annoying loop while we
check all the devices from -2147483648 to SNDRV_MINOR_HWDEPS.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: reshuffled it a bit per Walter Harms's suggestion.

diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index c7ceb28..75ea16f 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -273,7 +273,14 @@ static int snd_hwdep_control_ioctl(struct snd_card *card,
 			if (get_user(device, (int __user *)arg))
 				return -EFAULT;
 			mutex_lock(&register_mutex);
-			device = device < 0 ? 0 : device + 1;
+
+			if (device < 0)
+				device = 0;
+			else if (device < SNDRV_MINOR_HWDEPS)
+				device++;
+			else
+				device = SNDRV_MINOR_HWDEPS;
+
 			while (device < SNDRV_MINOR_HWDEPS) {
 				if (snd_hwdep_search(card, device))
 					break;

Re: [alsa-devel] [patch v2] [ALSA] hwdep: silence integer overflow warning

[Takashi Iwai]

At Fri, 28 Oct 2011 09:46:01 +0300,
Dan Carpenter wrote:
> 
> Smatch complains that if device is INT_MAX then device + 1 can
> overflow.  It just means we would have an annoying loop while we
> check all the devices from -2147483648 to SNDRV_MINOR_HWDEPS.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Applied now.  Thanks!


Takashi

> ---
> v2: reshuffled it a bit per Walter Harms's suggestion.
> 
> diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
> index c7ceb28..75ea16f 100644
> --- a/sound/core/hwdep.c
> +++ b/sound/core/hwdep.c
> @@ -273,7 +273,14 @@ static int snd_hwdep_control_ioctl(struct snd_card *card,
>  			if (get_user(device, (int __user *)arg))
>  				return -EFAULT;
>  			mutex_lock(&register_mutex);
> -			device = device < 0 ? 0 : device + 1;
> +
> +			if (device < 0)
> +				device = 0;
> +			else if (device < SNDRV_MINOR_HWDEPS)
> +				device++;
> +			else
> +				device = SNDRV_MINOR_HWDEPS;
> +
>  			while (device < SNDRV_MINOR_HWDEPS) {
>  				if (snd_hwdep_search(card, device))
>  					break;
> 
> _______________________________________________
> Alsa-devel mailing list
> Alsa-devel@alsa-project.org
> http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
>