Re: [PATCH] ALSA: pcm: oss: Compare max buffer size in bytes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] ALSA: oss: array3_size() overflow hits snd_BUG_ON() in
  snd_pcm_plugin_alloc()
--

commit 97a1260d8f9d7c584f3610ce297a74916707f416
Author: Takashi Iwai <tiwai@suse.de>

ALSA: pcm: oss: Compare max buffer size in bytes

This commit moves the 1MB upper-limit check in snd_pcm_plugin_alloc()
to after the bit-to-byte division so the limit is enforced in bytes
rather than bits.

> diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
> index 3de7137799936..c5b3c67345eeb 100644
> --- a/sound/core/oss/pcm_plugin.c
> +++ b/sound/core/oss/pcm_plugin.c
> @@ -48,12 +48,12 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t
>  	if (width < 0)
>  		return width;
>  	size = array3_size(frames, format->channels, width);
> -	/* check for too large period size once again */
> -	if (size > 1024 * 1024)
> -		return -ENOMEM;
>  	if (snd_BUG_ON(size % 8))
>  		return -ENXIO;
>  	size /= 8;
> +	/* check for too large period size once again */
> +	if (size > 1024 * 1024)
> +		return -ENOMEM;

[Severity: Medium]
Can a multiplication overflow in array3_size() now trigger snd_BUG_ON()?
When array3_size() overflows, it saturates to SIZE_MAX, where SIZE_MAX % 8
is 7.  With the size > 1024 * 1024 check moved past snd_BUG_ON(size % 8),
a saturated size hits the WARN_ON() in snd_BUG_ON() when CONFIG_SND_DEBUG
is enabled and returns -ENXIO instead of -ENOMEM.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112123430.684056-1-tiwai@suse.de?part=1