From: Geert Uytterhoeven <geert+renesas@glider.be>
To: Clemens Ladisch <clemens@ladisch.de>,
Takashi Sakamoto <o-takashi@sakamocchi.jp>,
Jaroslav Kysela <perex@perex.cz>, Takashi Iwai <tiwai@suse.com>
Cc: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org,
Geert Uytterhoeven <geert+renesas@glider.be>
Subject: [PATCH/RFC 1/2] ALSA: fireface: Fix integer overflow in transmit_midi_msg()
Date: Mon, 11 Jan 2021 14:02:50 +0100 [thread overview]
Message-ID: <20210111130251.361335-2-geert+renesas@glider.be> (raw)
In-Reply-To: <20210111130251.361335-1-geert+renesas@glider.be>
As snd_ff.rx_bytes[] is unsigned int, and NSEC_PER_SEC is 1000000000L,
the second multiplication in
ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250
always overflows on 32-bit platforms, truncating the result. Fix this
by precalculating "NSEC_PER_SEC / 31250", which is an integer constant.
Note that this assumes ff->rx_bytes[port] <= 16777.
Fixes: 19174295788de77d ("ALSA: fireface: add transaction support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
Compile-tested only.
I don't know the maximum transfer length of MIDI, but given it's an old
standard, I guess it's rather small. If it is larger than 16777, the
constant "8" should be replaced by "8ULL", to force 64-bit arithmetic.
---
sound/firewire/fireface/ff-transaction.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/firewire/fireface/ff-transaction.c b/sound/firewire/fireface/ff-transaction.c
index 7f82762ccc8c80ba..ee7122c461d46f44 100644
--- a/sound/firewire/fireface/ff-transaction.c
+++ b/sound/firewire/fireface/ff-transaction.c
@@ -88,7 +88,7 @@ static void transmit_midi_msg(struct snd_ff *ff, unsigned int port)
/* Set interval to next transaction. */
ff->next_ktime[port] = ktime_add_ns(ktime_get(),
- ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250);
+ ff->rx_bytes[port] * 8 * (NSEC_PER_SEC / 31250));
if (quad_count == 1)
tcode = TCODE_WRITE_QUADLET_REQUEST;
--
2.25.1
next prev parent reply other threads:[~2021-01-11 14:08 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-11 13:02 [PATCH/RFC 0/2] ALSA: firewire: Fix integer overflows on 32-bit Geert Uytterhoeven
2021-01-11 13:02 ` Geert Uytterhoeven [this message]
2021-01-12 13:53 ` [PATCH/RFC 1/2] ALSA: fireface: Fix integer overflow in transmit_midi_msg() Takashi Sakamoto
2021-01-12 13:53 ` Takashi Sakamoto
2021-01-12 13:58 ` Takashi Iwai
2021-01-12 13:58 ` Takashi Iwai
2021-01-11 13:02 ` [PATCH/RFC 2/2] ALSA: firewire-tascam: Fix integer overflow in midi_port_work() Geert Uytterhoeven
2021-01-12 13:42 ` Takashi Sakamoto
2021-01-12 13:42 ` Takashi Sakamoto
2021-01-12 13:55 ` Geert Uytterhoeven
2021-01-12 13:55 ` Geert Uytterhoeven
2021-01-12 13:58 ` Takashi Iwai
2021-01-12 13:58 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210111130251.361335-2-geert+renesas@glider.be \
--to=geert+renesas@glider.be \
--cc=alsa-devel@alsa-project.org \
--cc=clemens@ladisch.de \
--cc=linux-kernel@vger.kernel.org \
--cc=o-takashi@sakamocchi.jp \
--cc=perex@perex.cz \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.