ALSA: vx: Fix possible transfer overflow

The pseudo DMA transfer codes in VX222 and VX-pocket driver have a
slight bug where they check the buffer boundary wrongly, and may
overflow.  Also, the zero sample count might be handled badly for the
playback (although it shouldn't happen in theory).  This patch
addresses these issues.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=141541
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/drivers/vx/vx_pcm.c b/sound/drivers/vx/vx_pcm.c
index 11467272089e45632935912c4e2b94f8cb604978..41a617886cc78b75e974d542f144a29316fe3bdc 100644 (file)
--- a/sound/drivers/vx/vx_pcm.c
+++ b/sound/drivers/vx/vx_pcm.c
@@ -1048,8 +1048,10 @@ static void vx_pcm_capture_update(struct vx_core *chip, struct snd_pcm_substream
                /* ok, let's accelerate! */
                int align = pipe->align * 3;
                space = (count / align) * align;
-               vx_pseudo_dma_read(chip, runtime, pipe, space);
-               count -= space;
+               if (space > 0) {
+                       vx_pseudo_dma_read(chip, runtime, pipe, space);
+                       count -= space;
+               }
        }
        /* read the rest of bytes */
        while (count > 0) {

diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c
index af83b3b380523e75c897695a292bfecbdb2734fb..8e457ea27f8918e13a5e949d7ee243503b2f294f 100644 (file)
--- a/sound/pci/vx222/vx222_ops.c
+++ b/sound/pci/vx222/vx222_ops.c
@@ -269,12 +269,12 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
 
        /* Transfer using pseudo-dma.
         */
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 2; /* in 32bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0) {
+               for (; length > 0; length--) {
                        outl(cpu_to_le32(*addr), port);
                        addr++;
                }
@@ -284,7 +284,7 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 2; /* in 32bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 0) {
+       for (; count > 0; count--) {
                outl(cpu_to_le32(*addr), port);
                addr++;
        }
@@ -307,12 +307,12 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        vx2_setup_pseudo_dma(chip, 0);
        /* Transfer using pseudo-dma.
         */
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 2; /* in 32bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0)
+               for (; length > 0; length--)
                        *addr++ = le32_to_cpu(inl(port));
                addr = (u32 *)runtime->dma_area;
                pipe->hw_ptr = 0;
@@ -320,7 +320,7 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 2; /* in 32bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 0)
+       for (; count > 0; count--)
                *addr++ = le32_to_cpu(inl(port));
 
        vx2_release_pseudo_dma(chip);

diff --git a/sound/pcmcia/vx/vxp_ops.c b/sound/pcmcia/vx/vxp_ops.c
index 281972913c32140939c087067f4340d6882e6626..56aa1ba73ccc1ccb488bc662aa7ad459213eb696 100644 (file)
--- a/sound/pcmcia/vx/vxp_ops.c
+++ b/sound/pcmcia/vx/vxp_ops.c
@@ -369,12 +369,12 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        unsigned short *addr = (unsigned short *)(runtime->dma_area + offset);
 
        vx_setup_pseudo_dma(chip, 1);
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 1; /* in 16bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0) {
+               for (; length > 0; length--) {
                        outw(cpu_to_le16(*addr), port);
                        addr++;
                }
@@ -384,7 +384,7 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 1; /* in 16bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 0) {
+       for (; count > 0; count--) {
                outw(cpu_to_le16(*addr), port);
                addr++;
        }
@@ -411,12 +411,12 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        if (snd_BUG_ON(count % 2))
                return;
        vx_setup_pseudo_dma(chip, 0);
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 1; /* in 16bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0)
+               for (; length > 0; length--)
                        *addr++ = le16_to_cpu(inw(port));
                addr = (unsigned short *)runtime->dma_area;
                pipe->hw_ptr = 0;
@@ -424,7 +424,7 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 1; /* in 16bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 1)
+       for (; count > 1; count--)
                *addr++ = le16_to_cpu(inw(port));
        /* Disable DMA */
        pchip->regDIALOG &= ~VXP_DLG_DMAREAD_SEL_MASK;