ALSA: vx: Fix possible transfer overflow

[ Upstream commit 874e1f6fad9a5184b67f4cee37c1335cd2cc5677 ]

The pseudo DMA transfer codes in VX222 and VX-pocket driver have a
slight bug where they check the buffer boundary wrongly, and may
overflow.  Also, the zero sample count might be handled badly for the
playback (although it shouldn't happen in theory).  This patch
addresses these issues.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=141541
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/drivers/vx/vx_pcm.c b/sound/drivers/vx/vx_pcm.c
index 69f25258578044fb9e1fb2c6905bf2ab5423e1ad..ea7b377f03787cdb3ba5b21266b5df57b5b41340 100644 (file)
--- a/sound/drivers/vx/vx_pcm.c
+++ b/sound/drivers/vx/vx_pcm.c
@@ -1048,8 +1048,10 @@ static void vx_pcm_capture_update(struct vx_core *chip, struct snd_pcm_substream
                /* ok, let's accelerate! */
                int align = pipe->align * 3;
                space = (count / align) * align;
-               vx_pseudo_dma_read(chip, runtime, pipe, space);
-               count -= space;
+               if (space > 0) {
+                       vx_pseudo_dma_read(chip, runtime, pipe, space);
+                       count -= space;
+               }
        }
        /* read the rest of bytes */
        while (count > 0) {

diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c
index 2d1570273e99eb6d77bfcf03868c488af4554388..5c541ed723dd60ef771db4b70c324395075bee08 100644 (file)
--- a/sound/pci/vx222/vx222_ops.c
+++ b/sound/pci/vx222/vx222_ops.c
@@ -264,12 +264,12 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
 
        /* Transfer using pseudo-dma.
         */
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 2; /* in 32bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0) {
+               for (; length > 0; length--) {
                        outl(cpu_to_le32(*addr), port);
                        addr++;
                }
@@ -279,7 +279,7 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 2; /* in 32bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 0) {
+       for (; count > 0; count--) {
                outl(cpu_to_le32(*addr), port);
                addr++;
        }
@@ -302,12 +302,12 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        vx2_setup_pseudo_dma(chip, 0);
        /* Transfer using pseudo-dma.
         */
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 2; /* in 32bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0)
+               for (; length > 0; length--)
                        *addr++ = le32_to_cpu(inl(port));
                addr = (u32 *)runtime->dma_area;
                pipe->hw_ptr = 0;
@@ -315,7 +315,7 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 2; /* in 32bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 0)
+       for (; count > 0; count--)
                *addr++ = le32_to_cpu(inl(port));
 
        vx2_release_pseudo_dma(chip);

diff --git a/sound/pcmcia/vx/vxp_ops.c b/sound/pcmcia/vx/vxp_ops.c
index 281972913c32140939c087067f4340d6882e6626..56aa1ba73ccc1ccb488bc662aa7ad459213eb696 100644 (file)
--- a/sound/pcmcia/vx/vxp_ops.c
+++ b/sound/pcmcia/vx/vxp_ops.c
@@ -369,12 +369,12 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        unsigned short *addr = (unsigned short *)(runtime->dma_area + offset);
 
        vx_setup_pseudo_dma(chip, 1);
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 1; /* in 16bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0) {
+               for (; length > 0; length--) {
                        outw(cpu_to_le16(*addr), port);
                        addr++;
                }
@@ -384,7 +384,7 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 1; /* in 16bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 0) {
+       for (; count > 0; count--) {
                outw(cpu_to_le16(*addr), port);
                addr++;
        }
@@ -411,12 +411,12 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        if (snd_BUG_ON(count % 2))
                return;
        vx_setup_pseudo_dma(chip, 0);
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 1; /* in 16bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0)
+               for (; length > 0; length--)
                        *addr++ = le16_to_cpu(inw(port));
                addr = (unsigned short *)runtime->dma_area;
                pipe->hw_ptr = 0;
@@ -424,7 +424,7 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 1; /* in 16bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 1)
+       for (; count > 1; count--)
                *addr++ = le16_to_cpu(inw(port));
        /* Disable DMA */
        pchip->regDIALOG &= ~VXP_DLG_DMAREAD_SEL_MASK;