* [Qemu-devel] [PATCH] intel-hda: fix stream search
@ 2011-11-02 11:56 Gerd Hoffmann
2011-11-02 12:12 ` Markus Armbruster
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Gerd Hoffmann @ 2011-11-02 11:56 UTC (permalink / raw)
To: qemu-devel; +Cc: marcandre.lureau, Gerd Hoffmann
commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
The stream-not-found case doesn't error out any more, instead the
code silently uses the first stream. Fix it.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
hw/intel-hda.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/hw/intel-hda.c b/hw/intel-hda.c
index 675b659..b7ec36d 100644
--- a/hw/intel-hda.c
+++ b/hw/intel-hda.c
@@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
break;
}
}
- if (st == NULL) {
+ if (s == 4) {
return false;
}
if (st->bpl == NULL) {
--
1.7.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [Qemu-devel] [PATCH] intel-hda: fix stream search
2011-11-02 11:56 [Qemu-devel] [PATCH] intel-hda: fix stream search Gerd Hoffmann
@ 2011-11-02 12:12 ` Markus Armbruster
2011-11-02 12:18 ` Andreas Färber
2011-11-02 12:55 ` Anthony Liguori
2 siblings, 0 replies; 5+ messages in thread
From: Markus Armbruster @ 2011-11-02 12:12 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: marcandre.lureau, qemu-devel
Gerd Hoffmann <kraxel@redhat.com> writes:
> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
> The stream-not-found case doesn't error out any more, instead the
> code silently uses the first stream. Fix it.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH] intel-hda: fix stream search
2011-11-02 11:56 [Qemu-devel] [PATCH] intel-hda: fix stream search Gerd Hoffmann
2011-11-02 12:12 ` Markus Armbruster
@ 2011-11-02 12:18 ` Andreas Färber
2011-11-02 12:24 ` Kevin Wolf
2011-11-02 12:55 ` Anthony Liguori
2 siblings, 1 reply; 5+ messages in thread
From: Andreas Färber @ 2011-11-02 12:18 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: marcandre.lureau, qemu-devel
Am 02.11.2011 12:56, schrieb Gerd Hoffmann:
> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
> The stream-not-found case doesn't error out any more, instead the
> code silently uses the first stream. Fix it.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
> hw/intel-hda.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/hw/intel-hda.c b/hw/intel-hda.c
> index 675b659..b7ec36d 100644
> --- a/hw/intel-hda.c
> +++ b/hw/intel-hda.c
> @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
> break;
> }
> }
> - if (st == NULL) {
> + if (s == 4) {
> return false;
> }
> if (st->bpl == NULL) {
The commit message doesn't say it clearly: Is st == NULL impossible?
If not, this introduces a potential NULL pointer dereference at st->bpl.
Andreas
--
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [Qemu-devel] [PATCH] intel-hda: fix stream search
2011-11-02 12:18 ` Andreas Färber
@ 2011-11-02 12:24 ` Kevin Wolf
0 siblings, 0 replies; 5+ messages in thread
From: Kevin Wolf @ 2011-11-02 12:24 UTC (permalink / raw)
To: Andreas Färber; +Cc: marcandre.lureau, Gerd Hoffmann, qemu-devel
Am 02.11.2011 13:18, schrieb Andreas Färber:
> Am 02.11.2011 12:56, schrieb Gerd Hoffmann:
>> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
>> The stream-not-found case doesn't error out any more, instead the
>> code silently uses the first stream. Fix it.
>>
>> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
>> ---
>> hw/intel-hda.c | 2 +-
>> 1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/hw/intel-hda.c b/hw/intel-hda.c
>> index 675b659..b7ec36d 100644
>> --- a/hw/intel-hda.c
>> +++ b/hw/intel-hda.c
>> @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
>> break;
>> }
>> }
>> - if (st == NULL) {
>> + if (s == 4) {
>> return false;
>> }
>> if (st->bpl == NULL) {
>
> The commit message doesn't say it clearly: Is st == NULL impossible?
> If not, this introduces a potential NULL pointer dereference at st->bpl.
Yes, it's impossible. This is the full context:
st = output ? d->st + 4 : d->st;
for (s = 0; s < 4; s++) {
if (stnr == ((st[s].ctl >> 20) & 0x0f)) {
st = st + s;
break;
}
}
d->st is an array: IntelHDAStream st[8];
Kevin
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH] intel-hda: fix stream search
2011-11-02 11:56 [Qemu-devel] [PATCH] intel-hda: fix stream search Gerd Hoffmann
2011-11-02 12:12 ` Markus Armbruster
2011-11-02 12:18 ` Andreas Färber
@ 2011-11-02 12:55 ` Anthony Liguori
2 siblings, 0 replies; 5+ messages in thread
From: Anthony Liguori @ 2011-11-02 12:55 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: marcandre.lureau, qemu-devel
On 11/02/2011 06:56 AM, Gerd Hoffmann wrote:
> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
> The stream-not-found case doesn't error out any more, instead the
> code silently uses the first stream. Fix it.
>
> Signed-off-by: Gerd Hoffmann<kraxel@redhat.com>
Applied. Thanks.
Regards,
Anthony Liguori
> ---
> hw/intel-hda.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/hw/intel-hda.c b/hw/intel-hda.c
> index 675b659..b7ec36d 100644
> --- a/hw/intel-hda.c
> +++ b/hw/intel-hda.c
> @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
> break;
> }
> }
> - if (st == NULL) {
> + if (s == 4) {
> return false;
> }
> if (st->bpl == NULL) {
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2011-11-02 12:55 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-11-02 11:56 [Qemu-devel] [PATCH] intel-hda: fix stream search Gerd Hoffmann
2011-11-02 12:12 ` Markus Armbruster
2011-11-02 12:18 ` Andreas Färber
2011-11-02 12:24 ` Kevin Wolf
2011-11-02 12:55 ` Anthony Liguori
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).