[PATCH] ALSA: hwdep: fix a left shifting 1 by 31 UB bug

[PATCH] ALSA: hwdep: fix a left shifting 1 by 31 UB bug

[Changming Liu]

The "info.index" variable can be 31 in "1 << info.index".
This might trigger an undefined behavior since 1 is signed.

Fix this by casting 1 to 1u just to be sure "1u << 31" is defined.

Signed-off-by: Changming Liu <liu.changm@northeastern.edu>
---
 sound/core/hwdep.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index b412d3b3d5ff..21edb8ac95eb 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -216,12 +216,12 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw,
        if (info.index >= 32)
                return -EINVAL;
        /* check whether the dsp was already loaded */
-       if (hw->dsp_loaded & (1 << info.index))
+       if (hw->dsp_loaded & (1u << info.index))
                return -EBUSY;
        err = hw->ops.dsp_load(hw, &info);
        if (err < 0)
                return err;
-       hw->dsp_loaded |= (1 << info.index);
+       hw->dsp_loaded |= (1u << info.index);
        return 0;
 }

--
2.17.1

Re: [PATCH] ALSA: hwdep: fix a left shifting 1 by 31 UB bug

[Takashi Iwai]

On Tue, 26 May 2020 02:39:21 +0200,
Changming Liu wrote:
> 
> The "info.index" variable can be 31 in "1 << info.index".
> This might trigger an undefined behavior since 1 is signed.
> 
> Fix this by casting 1 to 1u just to be sure "1u << 31" is defined.
> 
> Signed-off-by: Changming Liu <liu.changm@northeastern.edu>

Thanks for the patch.

Unfortunately it seems that your MUA modified in quoted-printable and
inapplicable with git-am as is.  Since the changes are so small, I
manually applied it now.

Please fix the setup of your MUA at the next time, or better to try
git-send-email to submit directly.


thanks,

Takashi

> ---
>  sound/core/hwdep.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
> index b412d3b3d5ff..21edb8ac95eb 100644
> --- a/sound/core/hwdep.c
> +++ b/sound/core/hwdep.c
> @@ -216,12 +216,12 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw,
>         if (info.index >= 32)
>                 return -EINVAL;
>         /* check whether the dsp was already loaded */
> -       if (hw->dsp_loaded & (1 << info.index))
> +       if (hw->dsp_loaded & (1u << info.index))
>                 return -EBUSY;
>         err = hw->ops.dsp_load(hw, &info);
>         if (err < 0)
>                 return err;
> -       hw->dsp_loaded |= (1 << info.index);
> +       hw->dsp_loaded |= (1u << info.index);
>         return 0;
>  }
> 
> --
> 2.17.1
> 

RE: [PATCH] ALSA: hwdep: fix a left shifting 1 by 31 UB bug

[Changming Liu]

> From: Takashi Iwai <tiwai@suse.de>
> Sent: Tuesday, May 26, 2020 2:22 AM
> To: Changming Liu <liu.changm@northeastern.edu>
> Cc: perex@perex.cz; alsa-devel@alsa-project.org
> Subject: Re: [PATCH] ALSA: hwdep: fix a left shifting 1 by 31 UB bug
> 
> On Tue, 26 May 2020 02:39:21 +0200,
> Changming Liu wrote:
> >
> > The "info.index" variable can be 31 in "1 << info.index".
> > This might trigger an undefined behavior since 1 is signed.
> >
> > Fix this by casting 1 to 1u just to be sure "1u << 31" is defined.
> >
> > Signed-off-by: Changming Liu <liu.changm@northeastern.edu>
> 
> Thanks for the patch.
> 
> Unfortunately it seems that your MUA modified in quoted-printable and
> inapplicable with git-am as is.  Since the changes are so small, I
> manually applied it now.
>
I see, thank you very much for pointing out this problem, 
I'll never use my MUA to send patch again.
Also thank you for this manual modification. 

> Please fix the setup of your MUA at the next time, or better to try
> git-send-email to submit directly.
> 
Sorry that I cannot configure my university email to work on git-send-email,
I'll use my gmail to send patch via git next time.
 
> > ---
> >  sound/core/hwdep.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
> > index b412d3b3d5ff..21edb8ac95eb 100644
> > --- a/sound/core/hwdep.c
> > +++ b/sound/core/hwdep.c
> > @@ -216,12 +216,12 @@ static int snd_hwdep_dsp_load(struct snd_hwdep
> *hw,
> >         if (info.index >= 32)
> >                 return -EINVAL;
> >         /* check whether the dsp was already loaded */
> > -       if (hw->dsp_loaded & (1 << info.index))
> > +       if (hw->dsp_loaded & (1u << info.index))
> >                 return -EBUSY;
> >         err = hw->ops.dsp_load(hw, &info);
> >         if (err < 0)
> >                 return err;
> > -       hw->dsp_loaded |= (1 << info.index);
> > +       hw->dsp_loaded |= (1u << info.index);
> >         return 0;
> >  }
> >
> > --
> > 2.17.1
> >

Re: [PATCH] ALSA: hwdep: fix a left shifting 1 by 31 UB bug

[Takashi Iwai]

On Tue, 26 May 2020 18:06:02 +0200,
Changming Liu wrote:
> 
> > From: Takashi Iwai <tiwai@suse.de>
> > Sent: Tuesday, May 26, 2020 2:22 AM
> > To: Changming Liu <liu.changm@northeastern.edu>
> > Cc: perex@perex.cz; alsa-devel@alsa-project.org
> > Subject: Re: [PATCH] ALSA: hwdep: fix a left shifting 1 by 31 UB bug
> > 
> > On Tue, 26 May 2020 02:39:21 +0200,
> > Changming Liu wrote:
> > >
> > > The "info.index" variable can be 31 in "1 << info.index".
> > > This might trigger an undefined behavior since 1 is signed.
> > >
> > > Fix this by casting 1 to 1u just to be sure "1u << 31" is defined.
> > >
> > > Signed-off-by: Changming Liu <liu.changm@northeastern.edu>
> > 
> > Thanks for the patch.
> > 
> > Unfortunately it seems that your MUA modified in quoted-printable and
> > inapplicable with git-am as is.  Since the changes are so small, I
> > manually applied it now.
> >
> I see, thank you very much for pointing out this problem, 
> I'll never use my MUA to send patch again.
> Also thank you for this manual modification. 
> 
> > Please fix the setup of your MUA at the next time, or better to try
> > git-send-email to submit directly.
> > 
> Sorry that I cannot configure my university email to work on git-send-email,
> I'll use my gmail to send patch via git next time.

That should work.  In the worst case, use an attachment.


thanks,

Takashi