]> www.infradead.org Git - users/hch/dma-mapping.git/commit
ALSA: silence integer wrapping warning
authorDan Carpenter <dan.carpenter@linaro.org>
Mon, 30 Sep 2024 07:19:58 +0000 (10:19 +0300)
committerTakashi Iwai <tiwai@suse.de>
Tue, 1 Oct 2024 12:56:40 +0000 (14:56 +0200)
commita04dae6fa4fc56c6a29cd40e133ef6a77f2c7e4e
treeaef6688bd2d893308683903060ad837e3db27b65
parent8a193d8e351d185d75186bf0bdfa979e19d8fba8
ALSA: silence integer wrapping warning

This patch doesn't change runtime at all, it's just for kernel hardening.

The "count" here comes from the user and on 32bit systems, it leads to
integer wrapping when we pass it to compute_user_elem_size():

alloc_size = compute_user_elem_size(private_size, count);

However, the integer over is harmless because later "count" is checked
when we pass it to snd_ctl_new():

err = snd_ctl_new(&kctl, count, access, file);

These days as part of kernel hardening we're trying to avoid integer
overflows when they affect size_t type.  So to avoid the integer overflow
copy the check from snd_ctl_new() and do it at the start of the
snd_ctl_elem_add() function as well.

Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://patch.msgid.link/5457e8c1-01ff-4dd9-b49c-15b817f65ee7@stanley.mountain
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/control.c