From: Takashi Iwai <tiwai@suse.de>
To: "Zhang, Jun" <jun.zhang@intel.com>
Cc: "He, Bo" <bo.he@intel.com>,
"alsa-devel@alsa-project.org" <alsa-devel@alsa-project.org>,
"perex@perex.cz" <perex@perex.cz>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"Zhang, Yanmin" <yanmin.zhang@intel.com>
Subject: Re: [PATCH] ALSA: core: fix unsigned int pages overflow when comapred
Date: Thu, 19 Jul 2018 08:42:14 +0200 [thread overview]
Message-ID: <s5hmuun681l.wl-tiwai@suse.de> (raw)
In-Reply-To: <88DC34334CA3444C85D647DBFA962C272B0C4C34@SHSMSX104.ccr.corp.intel.com>
On Thu, 19 Jul 2018 08:08:06 +0200,
Zhang, Jun wrote:
>
> Hello, Takashi
>
> I think use our patch, it's NOT possible that the returned size is over sgbuf->tblsize.
>
> In function snd_malloc_sgbuf_pages,
>
> Pages is align page,
> sgbuf->tblsize is align 32*page,
> chunk is align 2^n*page,
>
> in our panic case, pages = 123, tlbsize = 128,
> 1st loop trunk = 32
> 2nd loop trunk = 32
> 3rd loop trunk = 32
> 4th loop trunk = 16
> 5th loop trunk = 16
> So in 5th loop pages-trunk = -5, which make dead loop.
Looking at the code again, yeah, you are right, that won't happen.
And now it becomes clear: the fundamental problem is that
snd_dma_alloc_pages_fallback() returns a larger size than requested.
It would be acceptable if the internal allocator aligns a larger size,
but it shouldn't appear in the returned size outside. I believe this
was just a misunderstanding of get_order() usage there.
(BTW, it's interesting that the allocation with a larger block worked
while allocation with a smaller chunk failed; it must be a rare case
and that's one of reasons this bug didn't hit frequently.)
That being said, what we should fix is rather the function
snd_dma_alloc_pages_fallback() to behave as expected, and it'll be
like the patch below.
thanks,
Takashi
--- a/sound/core/memalloc.c
+++ b/sound/core/memalloc.c
@@ -247,11 +247,10 @@ int snd_dma_alloc_pages_fallback(int type, struct device *device, size_t size,
return err;
if (size <= PAGE_SIZE)
return -ENOMEM;
+ size >>= 1;
aligned_size = PAGE_SIZE << get_order(size);
if (size != aligned_size)
size = aligned_size;
- else
- size >>= 1;
}
if (! dmab->area)
return -ENOMEM;
next prev parent reply other threads:[~2018-07-19 6:42 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-18 11:52 [PATCH] ALSA: core: fix unsigned int pages overflow when comapred He, Bo
2018-07-18 12:34 ` Takashi Iwai
2018-07-19 1:10 ` He, Bo
2018-07-19 6:08 ` Zhang, Jun
2018-07-19 6:42 ` Takashi Iwai [this message]
2018-07-19 9:11 ` Takashi Iwai
2018-07-23 0:47 ` He, Bo
2018-07-23 7:09 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=s5hmuun681l.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=alsa-devel@alsa-project.org \
--cc=bo.he@intel.com \
--cc=jun.zhang@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=perex@perex.cz \
--cc=yanmin.zhang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).