[Qemu-devel] [PATCH] intel-hda: fix stream search

[Qemu-devel] [PATCH] intel-hda: fix stream search

[Gerd Hoffmann]

commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
The stream-not-found case doesn't error out any more, instead the
code silently uses the first stream.  Fix it.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/intel-hda.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/hw/intel-hda.c b/hw/intel-hda.c
index 675b659..b7ec36d 100644
--- a/hw/intel-hda.c
+++ b/hw/intel-hda.c
@@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
             break;
         }
     }
-    if (st == NULL) {
+    if (s == 4) {
         return false;
     }
     if (st->bpl == NULL) {
-- 
1.7.1

Re: [Qemu-devel] [PATCH] intel-hda: fix stream search

[Markus Armbruster]

Gerd Hoffmann <kraxel@redhat.com> writes:

> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
> The stream-not-found case doesn't error out any more, instead the
> code silently uses the first stream.  Fix it.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Reviewed-by: Markus Armbruster <armbru@redhat.com>

Re: [Qemu-devel] [PATCH] intel-hda: fix stream search

[Andreas Färber]

Am 02.11.2011 12:56, schrieb Gerd Hoffmann:
> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
> The stream-not-found case doesn't error out any more, instead the
> code silently uses the first stream.  Fix it.
> 
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
>  hw/intel-hda.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/hw/intel-hda.c b/hw/intel-hda.c
> index 675b659..b7ec36d 100644
> --- a/hw/intel-hda.c
> +++ b/hw/intel-hda.c
> @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
>              break;
>          }
>      }
> -    if (st == NULL) {
> +    if (s == 4) {
>          return false;
>      }
>      if (st->bpl == NULL) {

The commit message doesn't say it clearly: Is st == NULL impossible?
If not, this introduces a potential NULL pointer dereference at st->bpl.

Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH] intel-hda: fix stream search

[Kevin Wolf]

Am 02.11.2011 13:18, schrieb Andreas Färber:
> Am 02.11.2011 12:56, schrieb Gerd Hoffmann:
>> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
>> The stream-not-found case doesn't error out any more, instead the
>> code silently uses the first stream.  Fix it.
>>
>> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
>> ---
>>  hw/intel-hda.c |    2 +-
>>  1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/hw/intel-hda.c b/hw/intel-hda.c
>> index 675b659..b7ec36d 100644
>> --- a/hw/intel-hda.c
>> +++ b/hw/intel-hda.c
>> @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
>>              break;
>>          }
>>      }
>> -    if (st == NULL) {
>> +    if (s == 4) {
>>          return false;
>>      }
>>      if (st->bpl == NULL) {
> 
> The commit message doesn't say it clearly: Is st == NULL impossible?
> If not, this introduces a potential NULL pointer dereference at st->bpl.

Yes, it's impossible. This is the full context:

    st = output ? d->st + 4 : d->st;
    for (s = 0; s < 4; s++) {
        if (stnr == ((st[s].ctl >> 20) & 0x0f)) {
            st = st + s;
            break;
        }
    }

d->st is an array: IntelHDAStream st[8];

Kevin

Re: [Qemu-devel] [PATCH] intel-hda: fix stream search

[Anthony Liguori]

On 11/02/2011 06:56 AM, Gerd Hoffmann wrote:
> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
> The stream-not-found case doesn't error out any more, instead the
> code silently uses the first stream.  Fix it.
>
> Signed-off-by: Gerd Hoffmann<kraxel@redhat.com>

Applied.  Thanks.

Regards,

Anthony Liguori

> ---
>   hw/intel-hda.c |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/hw/intel-hda.c b/hw/intel-hda.c
> index 675b659..b7ec36d 100644
> --- a/hw/intel-hda.c
> +++ b/hw/intel-hda.c
> @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
>               break;
>           }
>       }
> -    if (st == NULL) {
> +    if (s == 4) {
>           return false;
>       }
>       if (st->bpl == NULL) {