| Message ID | 20221121023329.2423665-1-zhongbaisong@huawei.com |
|---|---|
| State | New |
| Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org>
Delivered-To: ouuuleilei@gmail.com
Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1358285wrr;
Sun, 20 Nov 2022 18:46:42 -0800 (PST)
X-Google-Smtp-Source:
AA0mqf4HbHE9ANqmMoXINKAvFvcbQcggsp6aynZFdB8fdGQo7acINUVINK/tyi5BKkpfc4eH+mQc
X-Received: by 2002:aa7:84c5:0:b0:56b:f64b:b385 with SMTP id
x5-20020aa784c5000000b0056bf64bb385mr18060589pfn.68.1668998802272;
Sun, 20 Nov 2022 18:46:42 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1668998802; cv=none;
d=google.com; s=arc-20160816;
b=t8QHcQD7NKkKWS9Cx5pMPkResxbs5xr3Xyq7PeLstaNgBx5CE/0p+1vaADvC8g9/9L
PYaBVnSmw8rv5HdiyIbElGLVBLuzY3pyrOKylFy0B8vsPDxFhnuaLSP2OZtq5lk9ujSa
OHwtkIaW0TndPB/3h7hEac5yLyFc5RIqIuPRXbRSBP0gtO2HbxdEh1A0iEUAqDfCqGWw
Bk4FOWtpZA4m3yk3Zeayuztg5kEBByBe9cTIOAWj03KzP+PlX05064ZaYkhXTAYzJaQ+
jtAAxtNYSfP+QgdVe1bk/qVuq8PFwXNrC3FF6pM42Y+05fKrPeUn/RKFW3vIcYVut+we
gP+g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;
s=arc-20160816;
h=list-id:precedence:content-transfer-encoding:mime-version
:message-id:date:subject:cc:to:from;
bh=U8wtlFVRRnS/Qr8VVHP9K0Sn0UxhJN5wWgXJaH6waAM=;
b=T+ZL1heAiBssB3HvI4ErRtBKAWC6fygkZfR5ek+VlB1YmySKzyMzBk5I+lsUGXAnA7
cI5e6dpDvCp9ZYLCX0GaQ7WXiYrJ7x6KyQyumDnL/Iui+uHuaZDbYHOewFGCPR1FYHO5
mZ/2Tg7a9YhEvRL18kcb5cS3s+1n7PyIkUpdynnWVZlFO8NaiBWC7bbvrbgyrYzStue2
y+yGDB5J1+uNCDRDwmZlKBAl6jFMPiq0WR70JFNyunNs8XVxe0/B8MkK1NSkEDE1squu
47yHFf9DfmSsxrwFuFo9TUhumKsYdiEOANlzvH6tXwiOOkluiWkIQBrV431mbWG8qQei
U6dA==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::1:20 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com
Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20])
by mx.google.com with ESMTP id
q23-20020a632a17000000b0047693f9d264si9719577pgq.833.2022.11.20.18.46.25;
Sun, 20 Nov 2022 18:46:42 -0800 (PST)
Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::1:20 as permitted sender)
client-ip=2620:137:e000::1:20;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::1:20 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S229843AbiKUCde (ORCPT <rfc822;leviz.kernel.dev@gmail.com>
+ 99 others); Sun, 20 Nov 2022 21:33:34 -0500
Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47452 "EHLO
lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S229676AbiKUCdc (ORCPT
<rfc822;linux-kernel@vger.kernel.org>);
Sun, 20 Nov 2022 21:33:32 -0500
Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255])
by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 58FC21146F
for <linux-kernel@vger.kernel.org>;
Sun, 20 Nov 2022 18:33:31 -0800 (PST)
Received: from canpemm500005.china.huawei.com (unknown [172.30.72.56])
by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4NFrz216d0z15Mb6;
Mon, 21 Nov 2022 10:33:02 +0800 (CST)
Received: from huawei.com (10.175.104.82) by canpemm500005.china.huawei.com
(7.192.104.229) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Mon, 21 Nov
2022 10:33:29 +0800
From: Baisong Zhong <zhongbaisong@huawei.com>
To: <linux-kernel@vger.kernel.org>, <alsa-devel@alsa-project.org>
CC: <perex@perex.cz>, <tiwai@suse.com>, <zhongbaisong@huawei.com>,
<broonie@kernel.org>, <kuninori.morimoto.gx@renesas.com>
Subject: [PATCH -next] ALSA: pcm: fix undefined behavior in bit shift for
SNDRV_PCM_RATE_KNOT
Date: Mon, 21 Nov 2022 10:33:29 +0800
Message-ID: <20221121023329.2423665-1-zhongbaisong@huawei.com>
X-Mailer: git-send-email 2.25.1
MIME-Version: 1.0
Content-Transfer-Encoding: 7BIT
Content-Type: text/plain; charset=US-ASCII
X-Originating-IP: [10.175.104.82]
X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To
canpemm500005.china.huawei.com (7.192.104.229)
X-CFilter-Loop: Reflected
X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED,
SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?=
X-GMAIL-THRID: =?utf-8?q?1750072088027659774?=
X-GMAIL-MSGID: =?utf-8?q?1750072088027659774?=
|
| Series |
[-next] ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
|
|
Commit Message
Baisong Zhong
Nov. 21, 2022, 2:33 a.m. UTC
Shifting signed 32-bit value by 31 bits is undefined, so changing
significant bit to unsigned. The UBSAN warning calltrace like below:
UBSAN: shift-out-of-bounds in sound/core/pcm_native.c:2676:21
left shift of 1 by 31 places cannot be represented in type 'int'
...
Call Trace:
<TASK>
dump_stack_lvl+0x8d/0xcf
ubsan_epilogue+0xa/0x44
__ubsan_handle_shift_out_of_bounds+0x1e7/0x208
snd_pcm_open_substream+0x9f0/0xa90
snd_pcm_oss_open.part.26+0x313/0x670
snd_pcm_oss_open+0x30/0x40
soundcore_open+0x18b/0x2e0
chrdev_open+0xe2/0x270
do_dentry_open+0x2f7/0x620
path_openat+0xd66/0xe70
do_filp_open+0xe3/0x170
do_sys_openat2+0x357/0x4a0
do_sys_open+0x87/0xd0
do_syscall_64+0x34/0x80
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Baisong Zhong <zhongbaisong@huawei.com>
---
include/sound/pcm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
On Mon, 21 Nov 2022 03:33:29 +0100, Baisong Zhong wrote: > > Shifting signed 32-bit value by 31 bits is undefined, so changing > significant bit to unsigned. The UBSAN warning calltrace like below: > > UBSAN: shift-out-of-bounds in sound/core/pcm_native.c:2676:21 > left shift of 1 by 31 places cannot be represented in type 'int' > ... > Call Trace: > <TASK> > dump_stack_lvl+0x8d/0xcf > ubsan_epilogue+0xa/0x44 > __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 > snd_pcm_open_substream+0x9f0/0xa90 > snd_pcm_oss_open.part.26+0x313/0x670 > snd_pcm_oss_open+0x30/0x40 > soundcore_open+0x18b/0x2e0 > chrdev_open+0xe2/0x270 > do_dentry_open+0x2f7/0x620 > path_openat+0xd66/0xe70 > do_filp_open+0xe3/0x170 > do_sys_openat2+0x357/0x4a0 > do_sys_open+0x87/0xd0 > do_syscall_64+0x34/0x80 > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Baisong Zhong <zhongbaisong@huawei.com> > --- > include/sound/pcm.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/include/sound/pcm.h b/include/sound/pcm.h > index 7b1a022910e8..ec28c2ec89de 100644 > --- a/include/sound/pcm.h > +++ b/include/sound/pcm.h > @@ -123,7 +123,7 @@ struct snd_pcm_ops { > #define SNDRV_PCM_RATE_384000 (1<<14) /* 384000Hz */ > > #define SNDRV_PCM_RATE_CONTINUOUS (1<<30) /* continuous range */ > -#define SNDRV_PCM_RATE_KNOT (1<<31) /* supports more non-continuos rates */ > +#define SNDRV_PCM_RATE_KNOT (1U<<31) /* supports more non-continuos rates */ Could you rather update all SNDRV_PCM_RATE_* to 1U? Otherwise it'll look inconsistent. thanks, Takashi
在 2022/11/21 18:35, Takashi Iwai 写道: > On Mon, 21 Nov 2022 03:33:29 +0100, > Baisong Zhong wrote: >> >> Shifting signed 32-bit value by 31 bits is undefined, so changing >> significant bit to unsigned. The UBSAN warning calltrace like below: >> >> UBSAN: shift-out-of-bounds in sound/core/pcm_native.c:2676:21 >> left shift of 1 by 31 places cannot be represented in type 'int' >> ... >> Call Trace: >> <TASK> >> dump_stack_lvl+0x8d/0xcf >> ubsan_epilogue+0xa/0x44 >> __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 >> snd_pcm_open_substream+0x9f0/0xa90 >> snd_pcm_oss_open.part.26+0x313/0x670 >> snd_pcm_oss_open+0x30/0x40 >> soundcore_open+0x18b/0x2e0 >> chrdev_open+0xe2/0x270 >> do_dentry_open+0x2f7/0x620 >> path_openat+0xd66/0xe70 >> do_filp_open+0xe3/0x170 >> do_sys_openat2+0x357/0x4a0 >> do_sys_open+0x87/0xd0 >> do_syscall_64+0x34/0x80 >> >> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") >> Signed-off-by: Baisong Zhong <zhongbaisong@huawei.com> >> --- >> include/sound/pcm.h | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/include/sound/pcm.h b/include/sound/pcm.h >> index 7b1a022910e8..ec28c2ec89de 100644 >> --- a/include/sound/pcm.h >> +++ b/include/sound/pcm.h >> @@ -123,7 +123,7 @@ struct snd_pcm_ops { >> #define SNDRV_PCM_RATE_384000 (1<<14) /* 384000Hz */ >> >> #define SNDRV_PCM_RATE_CONTINUOUS (1<<30) /* continuous range */ >> -#define SNDRV_PCM_RATE_KNOT (1<<31) /* supports more non-continuos rates */ >> +#define SNDRV_PCM_RATE_KNOT (1U<<31) /* supports more non-continuos rates */ > > Could you rather update all SNDRV_PCM_RATE_* to 1U? > Otherwise it'll look inconsistent. > > > thanks, > > Takashi Hi, Takashi Thank you for your suggestion. I will update all SNDRV_PCM_RATE_* to 1U for consistency in v2. Baisong Zhong .
diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 7b1a022910e8..ec28c2ec89de 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -123,7 +123,7 @@ struct snd_pcm_ops { #define SNDRV_PCM_RATE_384000 (1<<14) /* 384000Hz */ #define SNDRV_PCM_RATE_CONTINUOUS (1<<30) /* continuous range */ -#define SNDRV_PCM_RATE_KNOT (1<<31) /* supports more non-continuos rates */ +#define SNDRV_PCM_RATE_KNOT (1U<<31) /* supports more non-continuos rates */ #define SNDRV_PCM_RATE_8000_44100 (SNDRV_PCM_RATE_8000|SNDRV_PCM_RATE_11025|\ SNDRV_PCM_RATE_16000|SNDRV_PCM_RATE_22050|\