From: Geert Uytterhoeven <geert+renesas@glider.be>
To: Clemens Ladisch <clemens@ladisch.de>,
Takashi Sakamoto <o-takashi@sakamocchi.jp>,
Jaroslav Kysela <perex@perex.cz>, Takashi Iwai <tiwai@suse.com>
Cc: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org,
Geert Uytterhoeven <geert+renesas@glider.be>
Subject: [PATCH/RFC 1/2] ALSA: fireface: Fix integer overflow in transmit_midi_msg()
Date: Mon, 11 Jan 2021 14:02:50 +0100 [thread overview]
Message-ID: <20210111130251.361335-2-geert+renesas@glider.be> (raw)
In-Reply-To: <20210111130251.361335-1-geert+renesas@glider.be>
As snd_ff.rx_bytes[] is unsigned int, and NSEC_PER_SEC is 1000000000L,
the second multiplication in
ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250
always overflows on 32-bit platforms, truncating the result. Fix this
by precalculating "NSEC_PER_SEC / 31250", which is an integer constant.
Note that this assumes ff->rx_bytes[port] <= 16777.
Fixes: 19174295788de77d ("ALSA: fireface: add transaction support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
Compile-tested only.
I don't know the maximum transfer length of MIDI, but given it's an old
standard, I guess it's rather small. If it is larger than 16777, the
constant "8" should be replaced by "8ULL", to force 64-bit arithmetic.
---
sound/firewire/fireface/ff-transaction.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/firewire/fireface/ff-transaction.c b/sound/firewire/fireface/ff-transaction.c
index 7f82762ccc8c80ba..ee7122c461d46f44 100644
--- a/sound/firewire/fireface/ff-transaction.c
+++ b/sound/firewire/fireface/ff-transaction.c
@@ -88,7 +88,7 @@ static void transmit_midi_msg(struct snd_ff *ff, unsigned int port)
/* Set interval to next transaction. */
ff->next_ktime[port] = ktime_add_ns(ktime_get(),
- ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250);
+ ff->rx_bytes[port] * 8 * (NSEC_PER_SEC / 31250));
if (quad_count == 1)
tcode = TCODE_WRITE_QUADLET_REQUEST;
--
2.25.1
next prev parent reply other threads:[~2021-01-11 13:05 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-11 13:02 [PATCH/RFC 0/2] ALSA: firewire: Fix integer overflows on 32-bit Geert Uytterhoeven
2021-01-11 13:02 ` Geert Uytterhoeven [this message]
2021-01-12 13:53 ` [PATCH/RFC 1/2] ALSA: fireface: Fix integer overflow in transmit_midi_msg() Takashi Sakamoto
2021-01-12 13:58 ` Takashi Iwai
2021-01-11 13:02 ` [PATCH/RFC 2/2] ALSA: firewire-tascam: Fix integer overflow in midi_port_work() Geert Uytterhoeven
2021-01-12 13:42 ` Takashi Sakamoto
2021-01-12 13:55 ` Geert Uytterhoeven
2021-01-12 13:58 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210111130251.361335-2-geert+renesas@glider.be \
--to=geert+renesas@glider.be \
--cc=alsa-devel@alsa-project.org \
--cc=clemens@ladisch.de \
--cc=linux-kernel@vger.kernel.org \
--cc=o-takashi@sakamocchi.jp \
--cc=perex@perex.cz \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).