diff mbox series

[PULL,2/3] hw/audio/virtio-snd: fix invalid param check

Message ID 7d14471a121878602cb4e748c4707f9ab9a9e3e2.1724151593.git.mst@redhat.com (mailing list archive)
State New, archived
Headers show
Series [PULL,1/3] vhost: Add VIRTIO_NET_F_RSC_EXT to vhost feature bits | expand

Commit Message

Michael S. Tsirkin Aug. 20, 2024, 11:01 a.m. UTC
From: Volker Rümelin <vr_qemu@t-online.de>

Commit 9b6083465f ("virtio-snd: check for invalid param shift
operands") tries to prevent invalid parameters specified by the
guest. However, the code is not correct.

Change the code so that the parameters format and rate, which are
a bit numbers, are compared with the bit size of the data type.

Fixes: 9b6083465f ("virtio-snd: check for invalid param shift operands")
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20240802071805.7123-1-vr_qemu@t-online.de>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/audio/virtio-snd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Volker Rümelin Aug. 30, 2024, 5:12 a.m. UTC | #1
Cc: qemu-stable@nongnu.org

Without this patch, the virtio-sound device will not work in the next
QEMU stable-8.2 and stable-9.0 versions.

With best regards,
Volker

> From: Volker Rümelin <vr_qemu@t-online.de>
>
> Commit 9b6083465f ("virtio-snd: check for invalid param shift
> operands") tries to prevent invalid parameters specified by the
> guest. However, the code is not correct.
>
> Change the code so that the parameters format and rate, which are
> a bit numbers, are compared with the bit size of the data type.
>
> Fixes: 9b6083465f ("virtio-snd: check for invalid param shift operands")
> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
> Message-Id: <20240802071805.7123-1-vr_qemu@t-online.de>
> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> ---
>  hw/audio/virtio-snd.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
> index e5196aa4bb..d1cf5eb445 100644
> --- a/hw/audio/virtio-snd.c
> +++ b/hw/audio/virtio-snd.c
> @@ -282,12 +282,12 @@ uint32_t virtio_snd_set_pcm_params(VirtIOSound *s,
>          error_report("Number of channels is not supported.");
>          return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
>      }
> -    if (BIT(params->format) > sizeof(supported_formats) ||
> +    if (params->format >= sizeof(supported_formats) * BITS_PER_BYTE ||
>          !(supported_formats & BIT(params->format))) {
>          error_report("Stream format is not supported.");
>          return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
>      }
> -    if (BIT(params->rate) > sizeof(supported_rates) ||
> +    if (params->rate >= sizeof(supported_rates) * BITS_PER_BYTE ||
>          !(supported_rates & BIT(params->rate))) {
>          error_report("Stream rate is not supported.");
>          return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
diff mbox series

Patch

diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index e5196aa4bb..d1cf5eb445 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -282,12 +282,12 @@  uint32_t virtio_snd_set_pcm_params(VirtIOSound *s,
         error_report("Number of channels is not supported.");
         return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
     }
-    if (BIT(params->format) > sizeof(supported_formats) ||
+    if (params->format >= sizeof(supported_formats) * BITS_PER_BYTE ||
         !(supported_formats & BIT(params->format))) {
         error_report("Stream format is not supported.");
         return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
     }
-    if (BIT(params->rate) > sizeof(supported_rates) ||
+    if (params->rate >= sizeof(supported_rates) * BITS_PER_BYTE ||
         !(supported_rates & BIT(params->rate))) {
         error_report("Stream rate is not supported.");
         return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);