From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754231AbXJVPYV (ORCPT ); Mon, 22 Oct 2007 11:24:21 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751987AbXJVPYO (ORCPT ); Mon, 22 Oct 2007 11:24:14 -0400 Received: from cantor2.suse.de ([195.135.220.15]:52805 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751880AbXJVPYN (ORCPT ); Mon, 22 Oct 2007 11:24:13 -0400 Date: Mon, 22 Oct 2007 16:07:54 +0200 Message-ID: From: Takashi Iwai To: Adrian Bunk Cc: perex@perex.cz, linux-kernel@vger.kernel.org Subject: Re: sound/pci/hda/patch_via.c: array overflow In-Reply-To: <20071019125709.GZ3778@stusta.de> References: <20071019125709.GZ3778@stusta.de> User-Agent: Wanderlust/2.15.5 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.7 (=?ISO-8859-4?Q?Sanj=F2?=) APEL/10.6 MULE XEmacs/21.5 (beta28) (fuki) (+CVS-20070806) (i386-suse-linux) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org At Fri, 19 Oct 2007 14:57:09 +0200, Adrian Bunk wrote: > > sound/pci/hda/patch_via.c contains the following code: > > <-- snip --> > > ... > struct via_spec { > ... > hda_nid_t private_dac_nids[4]; > ... ^^^ > }; > ... > static int vt1709_auto_fill_dac_nids(struct via_spec *spec, > const struct auto_pin_cfg *cfg) > { > ... > spec->multiout.dac_nids = spec->private_dac_nids; > > if (cfg->line_outs == 4) { /* 10 channels */ <------------------ > for (i = 0; i < cfg->line_outs; i++) { > nid = cfg->line_out_pins[i]; > if (nid) { > /* config dac list */ > switch (i) { > case AUTO_SEQ_FRONT: > /* AOW0 */ > spec->multiout.dac_nids[i] = 0x10; > break; > case AUTO_SEQ_CENLFE: > /* AOW2 */ > spec->multiout.dac_nids[i] = 0x12; > break; > case AUTO_SEQ_SURROUND: > /* AOW3 */ > spec->multiout.dac_nids[i] = 0x27; > break; > case AUTO_SEQ_SIDE: > /* AOW1 */ > spec->multiout.dac_nids[i] = 0x11; > break; > default: > break; > } > } > } > spec->multiout.dac_nids[cfg->line_outs] = 0x28; /* AOW4 */ > ... ^^^^^^^^^^^^^^ > > <-- snip --> > > Spotted by the Coverity checker. Thanks. The following patch was applied to ALSA tree. Takashi [ALSA] hda-codec - Fix possible array overflow dac_nids arrays in each codec support code may have up to 5 items when assigned from the auto-configurator. Some codec codes have less numbers than the possible max. This patch defines the constant and fixes the array definitions. Signed-off-by: Takashi Iwai --- diff -r 1ea57d99d2e5 -r 86919e2e4d61 sound/pci/hda/hda_local.h --- a/sound/pci/hda/hda_local.h Mon Oct 22 17:11:09 2007 +0200 +++ b/sound/pci/hda/hda_local.h Mon Oct 22 17:20:10 2007 +0200 @@ -310,16 +310,17 @@ enum { extern const char *auto_pin_cfg_labels[AUTO_PIN_LAST]; +#define AUTO_CFG_MAX_OUTS 5 + struct auto_pin_cfg { int line_outs; - hda_nid_t line_out_pins[5]; /* sorted in the order of - * Front/Surr/CLFE/Side - */ + /* sorted in the order of Front/Surr/CLFE/Side */ + hda_nid_t line_out_pins[AUTO_CFG_MAX_OUTS]; int speaker_outs; - hda_nid_t speaker_pins[5]; + hda_nid_t speaker_pins[AUTO_CFG_MAX_OUTS]; int hp_outs; int line_out_type; /* AUTO_PIN_XXX_OUT */ - hda_nid_t hp_pins[5]; + hda_nid_t hp_pins[AUTO_CFG_MAX_OUTS]; hda_nid_t input_pins[AUTO_PIN_LAST]; hda_nid_t dig_out_pin; hda_nid_t dig_in_pin; diff -r 1ea57d99d2e5 -r 86919e2e4d61 sound/pci/hda/patch_analog.c --- a/sound/pci/hda/patch_analog.c Mon Oct 22 17:11:09 2007 +0200 +++ b/sound/pci/hda/patch_analog.c Mon Oct 22 17:20:10 2007 +0200 @@ -72,7 +72,7 @@ struct ad198x_spec { unsigned int num_kctl_alloc, num_kctl_used; struct snd_kcontrol_new *kctl_alloc; struct hda_input_mux private_imux; - hda_nid_t private_dac_nids[4]; + hda_nid_t private_dac_nids[AUTO_CFG_MAX_OUTS]; unsigned int jack_present :1; diff -r 1ea57d99d2e5 -r 86919e2e4d61 sound/pci/hda/patch_cmedia.c --- a/sound/pci/hda/patch_cmedia.c Mon Oct 22 17:11:09 2007 +0200 +++ b/sound/pci/hda/patch_cmedia.c Mon Oct 22 17:20:10 2007 +0200 @@ -50,7 +50,7 @@ struct cmi_spec { /* playback */ struct hda_multi_out multiout; - hda_nid_t dac_nids[4]; /* NID for each DAC */ + hda_nid_t dac_nids[AUTO_CFG_MAX_OUTS]; /* NID for each DAC */ int num_dacs; /* capture */ @@ -73,7 +73,6 @@ struct cmi_spec { unsigned int pin_def_confs; /* multichannel pins */ - hda_nid_t multich_pin[4]; /* max 8-channel */ struct hda_verb multi_init[9]; /* 2 verbs for each pin + terminator */ }; diff -r 1ea57d99d2e5 -r 86919e2e4d61 sound/pci/hda/patch_conexant.c --- a/sound/pci/hda/patch_conexant.c Mon Oct 22 17:11:09 2007 +0200 +++ b/sound/pci/hda/patch_conexant.c Mon Oct 22 17:20:10 2007 +0200 @@ -85,7 +85,7 @@ struct conexant_spec { unsigned int num_kctl_alloc, num_kctl_used; struct snd_kcontrol_new *kctl_alloc; struct hda_input_mux private_imux; - hda_nid_t private_dac_nids[4]; + hda_nid_t private_dac_nids[AUTO_CFG_MAX_OUTS]; }; diff -r 1ea57d99d2e5 -r 86919e2e4d61 sound/pci/hda/patch_realtek.c --- a/sound/pci/hda/patch_realtek.c Mon Oct 22 17:11:09 2007 +0200 +++ b/sound/pci/hda/patch_realtek.c Mon Oct 22 17:20:10 2007 +0200 @@ -238,7 +238,7 @@ struct alc_spec { unsigned int num_kctl_alloc, num_kctl_used; struct snd_kcontrol_new *kctl_alloc; struct hda_input_mux private_imux; - hda_nid_t private_dac_nids[5]; + hda_nid_t private_dac_nids[AUTO_CFG_MAX_OUTS]; /* hooks */ void (*init_hook)(struct hda_codec *codec); diff -r 1ea57d99d2e5 -r 86919e2e4d61 sound/pci/hda/patch_via.c --- a/sound/pci/hda/patch_via.c Mon Oct 22 17:11:09 2007 +0200 +++ b/sound/pci/hda/patch_via.c Mon Oct 22 17:20:10 2007 +0200 @@ -114,7 +114,7 @@ struct via_spec { unsigned int num_kctl_alloc, num_kctl_used; struct snd_kcontrol_new *kctl_alloc; struct hda_input_mux private_imux; - hda_nid_t private_dac_nids[4]; + hda_nid_t private_dac_nids[AUTO_CFG_MAX_OUTS]; #ifdef CONFIG_SND_HDA_POWER_SAVE struct hda_loopback_check loopback;