linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>,
	Mark Brown <broonie@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 09/52] ALSA: compress: prevent potential divide by zero bugs
Date: Mon,  4 Mar 2019 09:22:07 +0100	[thread overview]
Message-ID: <20190304081617.671615552@linuxfoundation.org> (raw)
In-Reply-To: <20190304081617.159014799@linuxfoundation.org>

4.14-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 ]

The problem is seen in the q6asm_dai_compr_set_params() function:

	ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys,
				       (prtd->pcm_size / prtd->periods),
                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
				       prtd->periods);

In this code prtd->pcm_size is the buffer_size and prtd->periods comes
from params->buffer.fragments.  If we allow the number of fragments to
be zero then it results in a divide by zero bug.  One possible fix would
be to use prtd->pcm_count directly instead of using the division to
re-calculate it.  But I decided that it doesn't really make sense to
allow zero fragments.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/compress_offload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 4490a699030b1..555df64d46ffc 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params)
 {
 	/* first let's check the buffer parameter's */
 	if (params->buffer.fragment_size == 0 ||
-	    params->buffer.fragments > INT_MAX / params->buffer.fragment_size)
+	    params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
+	    params->buffer.fragments == 0)
 		return -EINVAL;
 
 	/* now codec parameters */
-- 
2.19.1




  parent reply	other threads:[~2019-03-04  8:26 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-04  8:21 [PATCH 4.14 00/52] 4.14.105-stable review Greg Kroah-Hartman
2019-03-04  8:21 ` [PATCH 4.14 01/52] Revert "loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()" Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 02/52] Revert "loop: Get rid of loop_index_mutex" Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 03/52] Revert "loop: Fold __loop_release into loop_release" Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 04/52] net: stmmac: Fix reception of Broadcom switches tags Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 05/52] net: stmmac: Disable ACS Feature for GMAC >= 4 Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 06/52] scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 07/52] drm/msm: Unblock writer if reader closes file Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 08/52] ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field Greg Kroah-Hartman
2019-03-04  8:22 ` Greg Kroah-Hartman [this message]
2019-03-04  8:22 ` [PATCH 4.14 10/52] ASoC: Variable "val" in function rt274_i2c_probe() could be uninitialized Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 11/52] clk: vc5: Abort clock configuration without upstream clock Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 12/52] thermal: int340x_thermal: Fix a NULL vs IS_ERR() check Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 13/52] usb: dwc3: gadget: synchronize_irq dwc irq in suspend Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 14/52] usb: dwc3: gadget: Fix the uninitialized link_state when udc starts Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 15/52] usb: gadget: Potential NULL dereference on allocation error Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 16/52] genirq: Make sure the initial affinity is not empty Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 17/52] ASoC: dapm: change snprintf to scnprintf for possible overflow Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 18/52] ASoC: imx-audmux: " Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 19/52] selftests: seccomp: use LDLIBS instead of LDFLAGS Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 20/52] selftests: gpio-mockup-chardev: Check asprintf() for error Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 21/52] ARC: fix __ffs return value to avoid build warnings Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 22/52] drivers: thermal: int340x_thermal: Fix sysfs race condition Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 23/52] staging: rtl8723bs: Fix build error with Clang when inlining is disabled Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 24/52] mac80211: fix miscounting of ttl-dropped frames Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 25/52] sched/wait: Fix rcuwait_wake_up() ordering Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 26/52] futex: Fix (possible) missed wakeup Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 27/52] locking/rwsem: " Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 28/52] drm/amd/powerplay: OD setting fix on Vega10 Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 29/52] serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 30/52] staging: android: ion: Support cpu access during dma_buf_detach Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 31/52] direct-io: allow direct writes to empty inodes Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 32/52] writeback: synchronize sync(2) against cgroup writeback membership switches Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 33/52] scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state() Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 34/52] net: altera_tse: fix connect_local_phy error path Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 35/52] hv_netvsc: Fix ethtool change hash key error Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 36/52] net: usb: asix: ax88772_bind return error when hw_reset fail Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 37/52] net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 38/52] ibmveth: Do not process frames after calling napi_reschedule Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 39/52] mac80211: dont initiate TDLS connection if station is not associated to AP Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 40/52] mac80211: Add attribute aligned(2) to struct action Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 41/52] cfg80211: extend range deviation for DMG Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 42/52] svm: Fix AVIC incomplete IPI emulation Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 43/52] KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1 Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 44/52] powerpc: Always initialize input array when calling epapr_hypercall() Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 45/52] mmc: spi: Fix card detection during probe Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 46/52] mmc: tmio_mmc_core: dont claim spurious interrupts Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 47/52] mmc: tmio: fix access width of Block Count Register Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 48/52] mmc: sdhci-esdhc-imx: correct the fix of ERR004536 Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 49/52] mm: enforce min addr even if capable() in expand_downwards() Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 50/52] MIPS: fix truncation in __cmpxchg_small for short values Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 51/52] MIPS: eBPF: Fix icache flush end address Greg Kroah-Hartman
2019-03-04  8:22 ` [PATCH 4.14 52/52] x86/uaccess: Dont leak the AC flag into __put_user() value evaluation Greg Kroah-Hartman
2019-03-04 18:42 ` [PATCH 4.14 00/52] 4.14.105-stable review Naresh Kamboju
2019-03-05  3:38 ` Guenter Roeck
2019-03-05 14:06 ` Jon Hunter
2019-03-05 16:11 ` shuah

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190304081617.671615552@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=broonie@kernel.org \
    --cc=dan.carpenter@oracle.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).