From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.5 required=3.0 tests=DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CD4FC433EF for ; Sun, 8 Sep 2019 21:40:31 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 675CB218AE for ; Sun, 8 Sep 2019 21:40:31 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OcsyunjJ" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 675CB218AE Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:50784 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1i74v8-00051n-IK for qemu-devel@archiver.kernel.org; Sun, 08 Sep 2019 17:40:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:46529) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1i74e7-0005hU-NP for qemu-devel@nongnu.org; Sun, 08 Sep 2019 17:22:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1i74e6-0005xc-JR for qemu-devel@nongnu.org; Sun, 08 Sep 2019 17:22:55 -0400 Received: from mail-qt1-x841.google.com ([2607:f8b0:4864:20::841]:44770) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1i74e6-0005xV-F9 for qemu-devel@nongnu.org; Sun, 08 Sep 2019 17:22:54 -0400 Received: by mail-qt1-x841.google.com with SMTP id u40so13809787qth.11 for ; Sun, 08 Sep 2019 14:22:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=csUz3G+oANfAghQDvskgbpzawb3MHELRqPU8L59Mp1o=; b=OcsyunjJNtAkuPt7vpVd6jf0lKMKzGLk3bCqAQhFP23C6Q86UcQTj1KMhXP0Uubac3 lO6UDBv5ftdUIuZmO8V+qAjgLGXwvrzwwrYdM35yGJcRPQYdcvguhUZae0/JTzeoHE2E rjXPoLbL3uzRZIjCPlC5h5J9+M8Sfi3A+k89YBRVKoWqNcZKLIgZmCQ9F2r6wTtq/I+0 MH5zFaU/DmQnhzZeCmqQqfeL8eYjvVk7ac5IJMfc563JxyR4+XYwxqu/JKJYQ4OMTOqP B319XiP28lE3TIWKJETMQyIoW9A8uJ6VL+h5X0RFV9h8TldbRvz3atzq9CRfmC+V73c4 HupA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=csUz3G+oANfAghQDvskgbpzawb3MHELRqPU8L59Mp1o=; b=INvpDlFdoNRp2ywq08D14WmKNMolll4p7arW9rke0mjfD5XuPfHO+y/WEJVKrWNAuS beno+2Hpdktt4A9JKxOOCJmqdmZJYcqaj7NIdNibMknLKQx+cS5MG92LwUahWnJ1tKAi kznvuKv/HDd7JlIxXYg7yDGH6z3Jy8kQ6CftVVkNa9nLVXVwiKGtkheTXUonD8A3/I1s IezyXZE8nAWptPAqoCoLvN/YdvEt2l115StcZL/I6xDDURNQ5mvlGwc+alWy1HOE19NF 6JHG2fmBBsUN+w0+ENJbw5s42wIc3J6UrIsZTHmUsNQs/KZtHtq3k+v44zH6rt/zkr4W 52PA== X-Gm-Message-State: APjAAAXcTuYZ1MU0GXtqv5AH6UTz6/ph3YBK02IfHbJRa1zWA/1MxTeq N5rm/vubrnQ/lczSLUwTLFhZItIu X-Google-Smtp-Source: APXvYqywry0X/CCyH+QYCkgaETwsDnr/Mf25VUB9Ra3PqE1ejKeL6POjySaM/t/C9+Z8eOL2PuOFmQ== X-Received: by 2002:ac8:7157:: with SMTP id h23mr19976859qtp.72.1567977773998; Sun, 08 Sep 2019 14:22:53 -0700 (PDT) Received: from nullptr.home.dirty-ice.org (2a01-036c-0113-6ea8-0000-0000-0000-0005.pool6.digikabel.hu. [2a01:36c:113:6ea8::5]) by smtp.gmail.com with ESMTPSA id e2sm5488112qkg.38.2019.09.08.14.22.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Sep 2019 14:22:53 -0700 (PDT) From: "=?UTF-8?q?K=C5=91v=C3=A1g=C3=B3=2C=20Zolt=C3=A1n?=" X-Google-Original-From: =?UTF-8?q?K=C5=91v=C3=A1g=C3=B3=2C=20Zolt=C3=A1n?= To: qemu-devel@nongnu.org Date: Sun, 8 Sep 2019 23:22:24 +0200 Message-Id: <4fa7311ce7888ed6bbb155b73c74b646a7974ec6.1567965065.git.DirtY.iCE.hu@gmail.com> X-Mailer: git-send-email 2.23.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4864:20::841 Subject: [Qemu-devel] [PATCH v2 24/24] usbaudio: change playback counters to 64 bit X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Gerd Hoffmann Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" With stereo playback, they need about 375 minutes of continuous audio playback to overflow, which is usually not a problem (as stopping and later resuming playback resets the counters). But with 7.1 audio, they only need about 95 minutes to overflow. After the overflow, the buf->prod % USBAUDIO_PACKET_SIZE(channels) assertion no longer holds true, which will result in overflowing the buffer. With 64 bit variables, it would take about 762000 years to overflow. Signed-off-by: Kővágó, Zoltán --- hw/usb/dev-audio.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c index e42bdfbdc1..ea604bbb8e 100644 --- a/hw/usb/dev-audio.c +++ b/hw/usb/dev-audio.c @@ -578,9 +578,9 @@ static const USBDesc desc_audio_multi = { struct streambuf { uint8_t *data; - uint32_t size; - uint32_t prod; - uint32_t cons; + size_t size; + uint64_t prod; + uint64_t cons; }; static void streambuf_init(struct streambuf *buf, uint32_t size, @@ -601,7 +601,7 @@ static void streambuf_fini(struct streambuf *buf) static int streambuf_put(struct streambuf *buf, USBPacket *p, uint32_t channels) { - uint32_t free = buf->size - (buf->prod - buf->cons); + int64_t free = buf->size - (buf->prod - buf->cons); if (free < USBAUDIO_PACKET_SIZE(channels)) { return 0; @@ -610,6 +610,8 @@ static int streambuf_put(struct streambuf *buf, USBPacket *p, uint32_t channels) return 0; } + /* can happen if prod overflows */ + assert(buf->prod % USBAUDIO_PACKET_SIZE(channels) == 0); usb_packet_copy(p, buf->data + (buf->prod % buf->size), USBAUDIO_PACKET_SIZE(channels)); buf->prod += USBAUDIO_PACKET_SIZE(channels); @@ -618,10 +620,10 @@ static int streambuf_put(struct streambuf *buf, USBPacket *p, uint32_t channels) static uint8_t *streambuf_get(struct streambuf *buf, size_t *len) { - uint32_t used = buf->prod - buf->cons; + int64_t used = buf->prod - buf->cons; uint8_t *data; - if (!used) { + if (used <= 0) { *len = 0; return NULL; } -- 2.23.0