From: Geert Uytterhoeven <geert+renesas@glider.be> To: Clemens Ladisch <clemens@ladisch.de>, Takashi Sakamoto <o-takashi@sakamocchi.jp>, Jaroslav Kysela <perex@perex.cz>, Takashi Iwai <tiwai@suse.com> Cc: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, Geert Uytterhoeven <geert+renesas@glider.be> Subject: [PATCH/RFC 1/2] ALSA: fireface: Fix integer overflow in transmit_midi_msg() Date: Mon, 11 Jan 2021 14:02:50 +0100 Message-ID: <20210111130251.361335-2-geert+renesas@glider.be> (raw) In-Reply-To: <20210111130251.361335-1-geert+renesas@glider.be> As snd_ff.rx_bytes[] is unsigned int, and NSEC_PER_SEC is 1000000000L, the second multiplication in ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250 always overflows on 32-bit platforms, truncating the result. Fix this by precalculating "NSEC_PER_SEC / 31250", which is an integer constant. Note that this assumes ff->rx_bytes[port] <= 16777. Fixes: 19174295788de77d ("ALSA: fireface: add transaction support") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> --- Compile-tested only. I don't know the maximum transfer length of MIDI, but given it's an old standard, I guess it's rather small. If it is larger than 16777, the constant "8" should be replaced by "8ULL", to force 64-bit arithmetic. --- sound/firewire/fireface/ff-transaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/firewire/fireface/ff-transaction.c b/sound/firewire/fireface/ff-transaction.c index 7f82762ccc8c80ba..ee7122c461d46f44 100644 --- a/sound/firewire/fireface/ff-transaction.c +++ b/sound/firewire/fireface/ff-transaction.c @@ -88,7 +88,7 @@ static void transmit_midi_msg(struct snd_ff *ff, unsigned int port) /* Set interval to next transaction. */ ff->next_ktime[port] = ktime_add_ns(ktime_get(), - ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250); + ff->rx_bytes[port] * 8 * (NSEC_PER_SEC / 31250)); if (quad_count == 1) tcode = TCODE_WRITE_QUADLET_REQUEST; -- 2.25.1
next prev parent reply index Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-01-11 13:02 [PATCH/RFC 0/2] ALSA: firewire: Fix integer overflows on 32-bit Geert Uytterhoeven 2021-01-11 13:02 ` Geert Uytterhoeven [this message] 2021-01-12 13:53 ` [PATCH/RFC 1/2] ALSA: fireface: Fix integer overflow in transmit_midi_msg() Takashi Sakamoto 2021-01-12 13:58 ` Takashi Iwai 2021-01-11 13:02 ` [PATCH/RFC 2/2] ALSA: firewire-tascam: Fix integer overflow in midi_port_work() Geert Uytterhoeven 2021-01-12 13:42 ` Takashi Sakamoto 2021-01-12 13:55 ` Geert Uytterhoeven 2021-01-12 13:58 ` Takashi Iwai
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210111130251.361335-2-geert+renesas@glider.be \ --to=geert+renesas@glider.be \ --cc=alsa-devel@alsa-project.org \ --cc=clemens@ladisch.de \ --cc=linux-kernel@vger.kernel.org \ --cc=o-takashi@sakamocchi.jp \ --cc=perex@perex.cz \ --cc=tiwai@suse.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Alsa-Devel Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/alsa-devel/0 alsa-devel/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 alsa-devel alsa-devel/ https://lore.kernel.org/alsa-devel \ alsa-devel@alsa-project.org public-inbox-index alsa-devel Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.alsa-project.alsa-devel AGPL code for this site: git clone https://public-inbox.org/public-inbox.git