From patchwork Wed Sep 13 23:01:16 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 9952269 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3EDB560360 for ; Wed, 13 Sep 2017 23:02:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2E363274D0 for ; Wed, 13 Sep 2017 23:02:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 211BB2891E; Wed, 13 Sep 2017 23:02:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 793B9274D0 for ; Wed, 13 Sep 2017 23:02:00 +0000 (UTC) Received: from alsa0.perex.cz (localhost [127.0.0.1]) by alsa0.perex.cz (Postfix) with ESMTP id 3ED38267144; Thu, 14 Sep 2017 01:01:59 +0200 (CEST) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 1F143267144; Thu, 14 Sep 2017 01:01:58 +0200 (CEST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by alsa0.perex.cz (Postfix) with ESMTP id B0EA9267168 for ; Thu, 14 Sep 2017 01:01:38 +0200 (CEST) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v8DN1WO7030964 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 13 Sep 2017 23:01:32 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v8DN1Vp9019997 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 13 Sep 2017 23:01:31 GMT Received: from ubhmp0014.oracle.com (ubhmp0014.oracle.com [156.151.24.67]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v8DN1SMQ015567; Wed, 13 Sep 2017 23:01:31 GMT Received: from mwanda (/41.202.241.15) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 13 Sep 2017 23:01:27 +0000 Date: Thu, 14 Sep 2017 02:01:16 +0300 From: Dan Carpenter To: Jaroslav Kysela Message-ID: <20170913230116.yspku7ov2hgqtigh@mwanda> MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email haha only kidding User-Agent: NeoMutt/20170609 (1.8.3) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Cc: alsa-devel@alsa-project.org, kernel-janitors@vger.kernel.org, Takashi Iwai Subject: [alsa-devel] [PATCH] ALSA: hwdep: prevent a harmless shift wrapping bug X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP The "info.index" variable represents a bit in hw->dsp_loaded which is an unsigned int. If it's higher than 31 we hit a shift wrapping bug. This seems harmless, but I wanted to silence the static checker warning. Signed-off-by: Dan Carpenter diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c index a73baa1242be..8faae3d1455d 100644 --- a/sound/core/hwdep.c +++ b/sound/core/hwdep.c @@ -228,6 +228,8 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw, memset(&info, 0, sizeof(info)); if (copy_from_user(&info, _info, sizeof(info))) return -EFAULT; + if (info.index >= 32) + return -EINVAL; /* check whether the dsp was already loaded */ if (hw->dsp_loaded & (1 << info.index)) return -EBUSY;