lkml.org 
[lkml]   [2017]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 20/38] ALSA: vx: Fix possible transfer overflow
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Takashi Iwai <tiwai@suse.de>


    [ Upstream commit 874e1f6fad9a5184b67f4cee37c1335cd2cc5677 ]

    The pseudo DMA transfer codes in VX222 and VX-pocket driver have a
    slight bug where they check the buffer boundary wrongly, and may
    overflow. Also, the zero sample count might be handled badly for the
    playback (although it shouldn't happen in theory). This patch
    addresses these issues.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=141541
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    sound/drivers/vx/vx_pcm.c | 6 ++++--
    sound/pci/vx222/vx222_ops.c | 12 ++++++------
    sound/pcmcia/vx/vxp_ops.c | 12 ++++++------
    3 files changed, 16 insertions(+), 14 deletions(-)

    --- a/sound/drivers/vx/vx_pcm.c
    +++ b/sound/drivers/vx/vx_pcm.c
    @@ -1048,8 +1048,10 @@ static void vx_pcm_capture_update(struct
    /* ok, let's accelerate! */
    int align = pipe->align * 3;
    space = (count / align) * align;
    - vx_pseudo_dma_read(chip, runtime, pipe, space);
    - count -= space;
    + if (space > 0) {
    + vx_pseudo_dma_read(chip, runtime, pipe, space);
    + count -= space;
    + }
    }
    /* read the rest of bytes */
    while (count > 0) {
    --- a/sound/pci/vx222/vx222_ops.c
    +++ b/sound/pci/vx222/vx222_ops.c
    @@ -264,12 +264,12 @@ static void vx2_dma_write(struct vx_core

    /* Transfer using pseudo-dma.
    */
    - if (offset + count > pipe->buffer_bytes) {
    + if (offset + count >= pipe->buffer_bytes) {
    int length = pipe->buffer_bytes - offset;
    count -= length;
    length >>= 2; /* in 32bit words */
    /* Transfer using pseudo-dma. */
    - while (length-- > 0) {
    + for (; length > 0; length--) {
    outl(cpu_to_le32(*addr), port);
    addr++;
    }
    @@ -279,7 +279,7 @@ static void vx2_dma_write(struct vx_core
    pipe->hw_ptr += count;
    count >>= 2; /* in 32bit words */
    /* Transfer using pseudo-dma. */
    - while (count-- > 0) {
    + for (; count > 0; count--) {
    outl(cpu_to_le32(*addr), port);
    addr++;
    }
    @@ -302,12 +302,12 @@ static void vx2_dma_read(struct vx_core
    vx2_setup_pseudo_dma(chip, 0);
    /* Transfer using pseudo-dma.
    */
    - if (offset + count > pipe->buffer_bytes) {
    + if (offset + count >= pipe->buffer_bytes) {
    int length = pipe->buffer_bytes - offset;
    count -= length;
    length >>= 2; /* in 32bit words */
    /* Transfer using pseudo-dma. */
    - while (length-- > 0)
    + for (; length > 0; length--)
    *addr++ = le32_to_cpu(inl(port));
    addr = (u32 *)runtime->dma_area;
    pipe->hw_ptr = 0;
    @@ -315,7 +315,7 @@ static void vx2_dma_read(struct vx_core
    pipe->hw_ptr += count;
    count >>= 2; /* in 32bit words */
    /* Transfer using pseudo-dma. */
    - while (count-- > 0)
    + for (; count > 0; count--)
    *addr++ = le32_to_cpu(inl(port));

    vx2_release_pseudo_dma(chip);
    --- a/sound/pcmcia/vx/vxp_ops.c
    +++ b/sound/pcmcia/vx/vxp_ops.c
    @@ -369,12 +369,12 @@ static void vxp_dma_write(struct vx_core
    unsigned short *addr = (unsigned short *)(runtime->dma_area + offset);

    vx_setup_pseudo_dma(chip, 1);
    - if (offset + count > pipe->buffer_bytes) {
    + if (offset + count >= pipe->buffer_bytes) {
    int length = pipe->buffer_bytes - offset;
    count -= length;
    length >>= 1; /* in 16bit words */
    /* Transfer using pseudo-dma. */
    - while (length-- > 0) {
    + for (; length > 0; length--) {
    outw(cpu_to_le16(*addr), port);
    addr++;
    }
    @@ -384,7 +384,7 @@ static void vxp_dma_write(struct vx_core
    pipe->hw_ptr += count;
    count >>= 1; /* in 16bit words */
    /* Transfer using pseudo-dma. */
    - while (count-- > 0) {
    + for (; count > 0; count--) {
    outw(cpu_to_le16(*addr), port);
    addr++;
    }
    @@ -411,12 +411,12 @@ static void vxp_dma_read(struct vx_core
    if (snd_BUG_ON(count % 2))
    return;
    vx_setup_pseudo_dma(chip, 0);
    - if (offset + count > pipe->buffer_bytes) {
    + if (offset + count >= pipe->buffer_bytes) {
    int length = pipe->buffer_bytes - offset;
    count -= length;
    length >>= 1; /* in 16bit words */
    /* Transfer using pseudo-dma. */
    - while (length-- > 0)
    + for (; length > 0; length--)
    *addr++ = le16_to_cpu(inw(port));
    addr = (unsigned short *)runtime->dma_area;
    pipe->hw_ptr = 0;
    @@ -424,7 +424,7 @@ static void vxp_dma_read(struct vx_core
    pipe->hw_ptr += count;
    count >>= 1; /* in 16bit words */
    /* Transfer using pseudo-dma. */
    - while (count-- > 1)
    + for (; count > 1; count--)
    *addr++ = le16_to_cpu(inw(port));
    /* Disable DMA */
    pchip->regDIALOG &= ~VXP_DLG_DMAREAD_SEL_MASK;

    \
     
     \ /
      Last update: 2017-11-19 16:19    [W:2.247 / U:0.744 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site