lkml.org 
[lkml]   [2019]   [Mar]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 09/52] ALSA: compress: prevent potential divide by zero bugs
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 ]

    The problem is seen in the q6asm_dai_compr_set_params() function:

    ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys,
    (prtd->pcm_size / prtd->periods),
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    prtd->periods);

    In this code prtd->pcm_size is the buffer_size and prtd->periods comes
    from params->buffer.fragments. If we allow the number of fragments to
    be zero then it results in a divide by zero bug. One possible fix would
    be to use prtd->pcm_count directly instead of using the division to
    re-calculate it. But I decided that it doesn't really make sense to
    allow zero fragments.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    sound/core/compress_offload.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
    index 4490a699030b1..555df64d46ffc 100644
    --- a/sound/core/compress_offload.c
    +++ b/sound/core/compress_offload.c
    @@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params)
    {
    /* first let's check the buffer parameter's */
    if (params->buffer.fragment_size == 0 ||
    - params->buffer.fragments > INT_MAX / params->buffer.fragment_size)
    + params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
    + params->buffer.fragments == 0)
    return -EINVAL;

    /* now codec parameters */
    --
    2.19.1


    \
     
     \ /
      Last update: 2019-03-04 09:26    [W:5.100 / U:0.824 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site