From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> To: Dan Carpenter <dan.carpenter@oracle.com> Cc: alsa-devel@alsa-project.org, Banajit Goswami <bgoswami@codeaurora.org>, Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Takashi Iwai <tiwai@suse.com>, Liam Girdwood <lgirdwood@gmail.com>, Mark Brown <broonie@kernel.org>, Srinivas Kandagatla <srinivas.kandagatla@linaro.org>, Banajit Goswami <bgoswami@quicinc.com> Subject: Re: [PATCH] ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() Date: Thu, 21 Jul 2022 12:30:32 +0200 [thread overview] Message-ID: <a29ea047-4935-4893-108b-f29f46971272@wanadoo.fr> (raw) In-Reply-To: <20220721100042.GL2338@kadam> Le 21/07/2022 à 12:00, Dan Carpenter a écrit : > On Thu, Jul 21, 2022 at 11:02:22AM +0200, Christophe JAILLET wrote: >> find_first_zero_bit() returns MAX_COPPS_PER_PORT at max here. >> So 'idx' should be tested with ">=" or the test can't match. >> >> Fixes: 7b20b2be51e1 ("ASoC: qdsp6: q6adm: Add q6adm driver") >> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> >> --- >> sound/soc/qcom/qdsp6/q6adm.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/sound/soc/qcom/qdsp6/q6adm.c b/sound/soc/qcom/qdsp6/q6adm.c >> index 01f383888b62..1530e98df165 100644 >> --- a/sound/soc/qcom/qdsp6/q6adm.c >> +++ b/sound/soc/qcom/qdsp6/q6adm.c >> @@ -217,7 +217,7 @@ static struct q6copp *q6adm_alloc_copp(struct q6adm *adm, int port_idx) >> idx = find_first_zero_bit(&adm->copp_bitmap[port_idx], >> MAX_COPPS_PER_PORT); >> >> - if (idx > MAX_COPPS_PER_PORT) >> + if (idx >= MAX_COPPS_PER_PORT) >> return ERR_PTR(-EBUSY); > > Harshit asked me to write a Smatch check to prevent this bug in the > future. I got his email before I got your patch. :P Attached. Well, well, well... Easy to say afterwards. You got 58 mins to write it. :). > > sound/soc/qcom/qdsp6/q6adm.c:220 q6adm_alloc_copp() warn: impossible find_next_bit condition > > I'll probably try to make this check more generic, but even the simple > find_first_zero_bit() version will probably find bugs in the future and > it was pretty simple to write. You could add find_last_bit(), find_next_zero_bit_le() and find_next_bit_le(). > > regards, > dan carpenter > > A reduced version of mine was: @@ expression e1, e2; statement S; @@ ( * e1 = find_first_bit(...); | * e1 = find_last_bit(...); | [... snip ...] ) ... if (e1 > e2) S (and it takes only a few seconds to scan the whole kernel :) )
WARNING: multiple messages have this Message-ID (diff)
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> To: Dan Carpenter <dan.carpenter@oracle.com> Cc: alsa-devel@alsa-project.org, Banajit Goswami <bgoswami@codeaurora.org>, Banajit Goswami <bgoswami@quicinc.com>, Liam Girdwood <lgirdwood@gmail.com>, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, Takashi Iwai <tiwai@suse.com>, Mark Brown <broonie@kernel.org>, Srinivas Kandagatla <srinivas.kandagatla@linaro.org>, Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Subject: Re: [PATCH] ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() Date: Thu, 21 Jul 2022 12:30:32 +0200 [thread overview] Message-ID: <a29ea047-4935-4893-108b-f29f46971272@wanadoo.fr> (raw) In-Reply-To: <20220721100042.GL2338@kadam> Le 21/07/2022 à 12:00, Dan Carpenter a écrit : > On Thu, Jul 21, 2022 at 11:02:22AM +0200, Christophe JAILLET wrote: >> find_first_zero_bit() returns MAX_COPPS_PER_PORT at max here. >> So 'idx' should be tested with ">=" or the test can't match. >> >> Fixes: 7b20b2be51e1 ("ASoC: qdsp6: q6adm: Add q6adm driver") >> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> >> --- >> sound/soc/qcom/qdsp6/q6adm.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/sound/soc/qcom/qdsp6/q6adm.c b/sound/soc/qcom/qdsp6/q6adm.c >> index 01f383888b62..1530e98df165 100644 >> --- a/sound/soc/qcom/qdsp6/q6adm.c >> +++ b/sound/soc/qcom/qdsp6/q6adm.c >> @@ -217,7 +217,7 @@ static struct q6copp *q6adm_alloc_copp(struct q6adm *adm, int port_idx) >> idx = find_first_zero_bit(&adm->copp_bitmap[port_idx], >> MAX_COPPS_PER_PORT); >> >> - if (idx > MAX_COPPS_PER_PORT) >> + if (idx >= MAX_COPPS_PER_PORT) >> return ERR_PTR(-EBUSY); > > Harshit asked me to write a Smatch check to prevent this bug in the > future. I got his email before I got your patch. :P Attached. Well, well, well... Easy to say afterwards. You got 58 mins to write it. :). > > sound/soc/qcom/qdsp6/q6adm.c:220 q6adm_alloc_copp() warn: impossible find_next_bit condition > > I'll probably try to make this check more generic, but even the simple > find_first_zero_bit() version will probably find bugs in the future and > it was pretty simple to write. You could add find_last_bit(), find_next_zero_bit_le() and find_next_bit_le(). > > regards, > dan carpenter > > A reduced version of mine was: @@ expression e1, e2; statement S; @@ ( * e1 = find_first_bit(...); | * e1 = find_last_bit(...); | [... snip ...] ) ... if (e1 > e2) S (and it takes only a few seconds to scan the whole kernel :) )
next prev parent reply other threads:[~2022-07-21 10:30 UTC|newest] Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-07-21 9:02 [PATCH] ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() Christophe JAILLET 2022-07-21 9:02 ` Christophe JAILLET 2022-07-21 10:00 ` Dan Carpenter 2022-07-21 10:00 ` Dan Carpenter 2022-07-21 10:30 ` Christophe JAILLET [this message] 2022-07-21 10:30 ` Christophe JAILLET 2022-07-21 10:47 ` Dan Carpenter 2022-07-21 10:47 ` Dan Carpenter 2022-07-22 6:30 ` Dan Carpenter 2022-07-22 6:30 ` Dan Carpenter 2022-07-21 10:32 ` Dan Carpenter 2022-07-21 10:32 ` Dan Carpenter 2022-07-22 12:48 ` Mark Brown 2022-07-22 12:48 ` Mark Brown
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=a29ea047-4935-4893-108b-f29f46971272@wanadoo.fr \ --to=christophe.jaillet@wanadoo.fr \ --cc=alsa-devel@alsa-project.org \ --cc=bgoswami@codeaurora.org \ --cc=bgoswami@quicinc.com \ --cc=broonie@kernel.org \ --cc=dan.carpenter@oracle.com \ --cc=harshit.m.mogalapalli@oracle.com \ --cc=kernel-janitors@vger.kernel.org \ --cc=lgirdwood@gmail.com \ --cc=linux-kernel@vger.kernel.org \ --cc=srinivas.kandagatla@linaro.org \ --cc=tiwai@suse.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.