From mboxrd@z Thu Jan  1 00:00:00 1970
From: Takashi Iwai <tiwai@suse.de>
Subject: Re: [Sound-open-firmware] [PATCH v5 09/14] ASoC: SOF:
	Add firmware loader support
Date: Thu, 04 Apr 2019 16:05:34 +0200
Message-ID: <s5hr2ahc1ch.wl-tiwai@suse.de>
References: <20190321161016.26515-1-pierre-louis.bossart@linux.intel.com>
 <20190321161016.26515-10-pierre-louis.bossart@linux.intel.com>
 <s5hy34pc36h.wl-tiwai@suse.de>
 <c9f87678-7387-8927-9bc1-803b879a7815@linux.intel.com>
Mime-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <alsa-devel-bounces@alsa-project.org>
In-Reply-To: <c9f87678-7387-8927-9bc1-803b879a7815@linux.intel.com>
List-Unsubscribe: <https://mailman.alsa-project.org/mailman/options/alsa-devel>,
 <mailto:alsa-devel-request@alsa-project.org?subject=unsubscribe>
List-Archive: <http://mailman.alsa-project.org/pipermail/alsa-devel/>
List-Post: <mailto:alsa-devel@alsa-project.org>
List-Help: <mailto:alsa-devel-request@alsa-project.org?subject=help>
List-Subscribe: <https://mailman.alsa-project.org/mailman/listinfo/alsa-devel>,
 <mailto:alsa-devel-request@alsa-project.org?subject=subscribe>
Errors-To: alsa-devel-bounces@alsa-project.org
Sender: "Alsa-devel" <alsa-devel-bounces@alsa-project.org>
To: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Cc: alsa-devel@alsa-project.org, sound-open-firmware@alsa-project.org, Daniel Baluta <daniel.baluta@gmail.com>, liam.r.girdwood@linux.intel.com, vkoul@kernel.org, broonie@kernel.org, andriy.shevchenko@linux.intel.com, Alan Cox <alan@linux.intel.com>
List-Id: alsa-devel@alsa-project.org

On Thu, 04 Apr 2019 15:59:46 +0200,
Pierre-Louis Bossart wrote:
> 
> >> +/* generic module parser for mmaped DSPs */
> >> +int snd_sof_parse_module_memcpy(struct snd_sof_dev *sdev,
> >> +				struct snd_sof_mod_hdr *module)
> >> +{
> >> +	struct snd_sof_blk_hdr *block;
> >> +	int count;
> >> +	u32 offset;
> >> +	size_t remaining;
> >> +
> >> +	dev_dbg(sdev->dev, "new module size 0x%x blocks 0x%x type 0x%x\n",
> >> +		module->size, module->num_blocks, module->type);
> >> +
> >> +	block = (struct snd_sof_blk_hdr *)((u8 *)module + sizeof(*module));
> >> +
> >> +	/* module->size doesn't include header size */
> >> +	remaining = module->size;
> >> +	for (count = 0; count < module->num_blocks; count++) {
> >> +		/* minus header size of block */
> >> +		remaining -= sizeof(*block);
> >> +		if (remaining < block->size) {
> >> +			dev_err(sdev->dev, "error: not enough data remaining\n");
> >> +			return -EINVAL;
> >> +		}
> >
> > remaining is unsigned, so a negative check doesn't work here.
> > Hence you need the explicit underflow check.
> 
> yes, probably need ssize_t here.

Be careful.  If block->size is unsigned, the comparison is also done
as unsigned in the code above.


Takashi