From patchwork Wed May 27 15:02:59 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Takashi Sakamoto X-Patchwork-Id: 6490441 Return-Path: X-Original-To: patchwork-alsa-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 25B72C0020 for ; Wed, 27 May 2015 15:03:32 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 8BE81206A4 for ; Wed, 27 May 2015 15:03:28 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.kernel.org (Postfix) with ESMTP id 04C3620698 for ; Wed, 27 May 2015 15:03:22 +0000 (UTC) Received: by alsa0.perex.cz (Postfix, from userid 1000) id A8B11265D4A; Wed, 27 May 2015 17:03:20 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from alsa0.perex.cz (localhost [IPv6:::1]) by alsa0.perex.cz (Postfix) with ESMTP id CDEC1265AF3; Wed, 27 May 2015 17:03:12 +0200 (CEST) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 9FAED265B58; Wed, 27 May 2015 17:03:11 +0200 (CEST) Received: from smtp311.phy.lolipop.jp (smtp311.phy.lolipop.jp [210.157.22.79]) by alsa0.perex.cz (Postfix) with ESMTP id 43270265ACA for ; Wed, 27 May 2015 17:03:04 +0200 (CEST) Received: from smtp311.phy.lolipop.lan (HELO smtp311.phy.lolipop.jp) (172.17.1.11) (smtp-auth username m12129643-o-takashi, mechanism plain) by smtp311.phy.lolipop.jp (qpsmtpd/0.82) with ESMTPA; Thu, 28 May 2015 00:03:01 +0900 Received: from 127.0.0.1 (127.0.0.1) by smtp311.phy.lolipop.jp (LOLIPOP-Fsecure); Thu, 28 May 2015 00:02:59 +0900 (JST) X-Virus-Status: clean(LOLIPOP-Fsecure) From: Takashi Sakamoto To: clemens@ladisch.de, tiwai@suse.de Date: Thu, 28 May 2015 00:02:59 +0900 Message-Id: <1432738979-13562-1-git-send-email-o-takashi@sakamocchi.jp> X-Mailer: git-send-email 2.1.4 Cc: alsa-devel@alsa-project.org, dan.carpenter@oracle.com, ffado-devel@lists.sf.net Subject: [alsa-devel] [PATCH] ALSA: firewire-lib: fix buffer-over-run when detecting packet discontinuity X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP When detecting packet discontinuity, handle_in_packet() returns minus value and this value is assigned to unsigned int variable, then the variable has huge value. As a result, the variable causes buffer-over-run in handle_out_packet(). This brings invalid page request and system hangup. This commit fixes the bug to add a new argument into handle_in_packet() and the number of handled data blocks is assignd to it. The function return value is just used to check error. I also considered to change the type of local variable to 'int' in in_stream_callback(). This idea is based on type-conversion in C standard, while it may cause future problems when adding more works. Thus, I dropped this idea. Fixes: 6fc6b9ce41c6('ALSA: firewire-lib: pass the number of data blocks in incoming packets to outgoing packets') Reported-by: Dan Carpenter Signed-off-by: Takashi Sakamoto --- sound/firewire/amdtp.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c index 2b3e8b1..7bb988f 100644 --- a/sound/firewire/amdtp.c +++ b/sound/firewire/amdtp.c @@ -688,10 +688,10 @@ static int handle_out_packet(struct amdtp_stream *s, unsigned int data_blocks, } static int handle_in_packet(struct amdtp_stream *s, - unsigned int payload_quadlets, __be32 *buffer) + unsigned int payload_quadlets, __be32 *buffer, + unsigned int *data_blocks) { u32 cip_header[2]; - unsigned int data_blocks; unsigned int data_block_quadlets, data_block_counter, dbc_interval; struct snd_pcm_substream *pcm = NULL; bool lost; @@ -709,7 +709,7 @@ static int handle_in_packet(struct amdtp_stream *s, dev_info_ratelimited(&s->unit->device, "Invalid CIP header for AMDTP: %08X:%08X\n", cip_header[0], cip_header[1]); - data_blocks = 0; + *data_blocks = 0; goto end; } @@ -717,7 +717,7 @@ static int handle_in_packet(struct amdtp_stream *s, if (payload_quadlets < 3 || ((cip_header[1] & CIP_FDF_MASK) == (AMDTP_FDF_NO_DATA << CIP_FDF_SHIFT))) { - data_blocks = 0; + *data_blocks = 0; } else { data_block_quadlets = (cip_header[0] & CIP_DBS_MASK) >> CIP_DBS_SHIFT; @@ -731,12 +731,12 @@ static int handle_in_packet(struct amdtp_stream *s, if (s->flags & CIP_WRONG_DBS) data_block_quadlets = s->data_block_quadlets; - data_blocks = (payload_quadlets - 2) / data_block_quadlets; + *data_blocks = (payload_quadlets - 2) / data_block_quadlets; } /* Check data block counter continuity */ data_block_counter = cip_header[0] & CIP_DBC_MASK; - if (data_blocks == 0 && (s->flags & CIP_EMPTY_HAS_WRONG_DBC) && + if (*data_blocks == 0 && (s->flags & CIP_EMPTY_HAS_WRONG_DBC) && s->data_block_counter != UINT_MAX) data_block_counter = s->data_block_counter; @@ -746,10 +746,10 @@ static int handle_in_packet(struct amdtp_stream *s, } else if (!(s->flags & CIP_DBC_IS_END_EVENT)) { lost = data_block_counter != s->data_block_counter; } else { - if ((data_blocks > 0) && (s->tx_dbc_interval > 0)) + if ((*data_blocks > 0) && (s->tx_dbc_interval > 0)) dbc_interval = s->tx_dbc_interval; else - dbc_interval = data_blocks; + dbc_interval = *data_blocks; lost = data_block_counter != ((s->data_block_counter + dbc_interval) & 0xff); @@ -762,30 +762,30 @@ static int handle_in_packet(struct amdtp_stream *s, return -EIO; } - if (data_blocks > 0) { + if (*data_blocks > 0) { buffer += 2; pcm = ACCESS_ONCE(s->pcm); if (pcm) - s->transfer_samples(s, pcm, buffer, data_blocks); + s->transfer_samples(s, pcm, buffer, *data_blocks); if (s->midi_ports) - read_midi_messages(s, buffer, data_blocks); + read_midi_messages(s, buffer, *data_blocks); } if (s->flags & CIP_DBC_IS_END_EVENT) s->data_block_counter = data_block_counter; else s->data_block_counter = - (data_block_counter + data_blocks) & 0xff; + (data_block_counter + *data_blocks) & 0xff; end: if (queue_in_packet(s) < 0) return -EIO; if (pcm) - update_pcm_pointers(s, pcm, data_blocks); + update_pcm_pointers(s, pcm, *data_blocks); - return data_blocks; + return 0; } static void out_stream_callback(struct fw_iso_context *context, u32 cycle, @@ -853,8 +853,8 @@ static void in_stream_callback(struct fw_iso_context *context, u32 cycle, break; } - data_blocks = handle_in_packet(s, payload_quadlets, buffer); - if (data_blocks < 0) { + if (handle_in_packet(s, payload_quadlets, buffer, + &data_blocks) < 0) { s->packet_index = -1; break; }