1 From 46df7aa08cd2c627933e0943a7982bcd97953745 Mon Sep 17 00:00:00 2001
2 From: Dan Carpenter <dan.carpenter@oracle.com>
3 Date: Fri, 21 Dec 2018 12:06:58 +0300
4 Subject: ALSA: compress: prevent potential divide by zero bugs
6 [ Upstream commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 ]
8 The problem is seen in the q6asm_dai_compr_set_params() function:
10 ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys,
11 (prtd->pcm_size / prtd->periods),
12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
15 In this code prtd->pcm_size is the buffer_size and prtd->periods comes
16 from params->buffer.fragments. If we allow the number of fragments to
17 be zero then it results in a divide by zero bug. One possible fix would
18 be to use prtd->pcm_count directly instead of using the division to
19 re-calculate it. But I decided that it doesn't really make sense to
22 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
23 Signed-off-by: Mark Brown <broonie@kernel.org>
24 Signed-off-by: Sasha Levin <sashal@kernel.org>
26 sound/core/compress_offload.c | 3 ++-
27 1 file changed, 2 insertions(+), 1 deletion(-)
29 diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
30 index 4490a699030b1..555df64d46ffc 100644
31 --- a/sound/core/compress_offload.c
32 +++ b/sound/core/compress_offload.c
33 @@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params)
35 /* first let's check the buffer parameter's */
36 if (params->buffer.fragment_size == 0 ||
37 - params->buffer.fragments > INT_MAX / params->buffer.fragment_size)
38 + params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
39 + params->buffer.fragments == 0)
42 /* now codec parameters */