| From: Takashi Iwai <tiwai@suse.de> |
| Date: Mon, 25 Jun 2018 11:09:11 +0200 |
| Subject: ALSA: timer: Fix UBSAN warning at SNDRV_TIMER_IOCTL_NEXT_DEVICE ioctl |
| |
| commit b41f794f284966fd6ec634111e3b40d241389f96 upstream. |
| |
| The kernel may spew a WARNING about UBSAN undefined behavior at |
| handling ALSA timer ioctl SNDRV_TIMER_IOCTL_NEXT_DEVICE: |
| |
| UBSAN: Undefined behaviour in sound/core/timer.c:1524:19 |
| signed integer overflow: |
| 2147483647 + 1 cannot be represented in type 'int' |
| Call Trace: |
| __dump_stack lib/dump_stack.c:77 [inline] |
| dump_stack+0x122/0x1c8 lib/dump_stack.c:113 |
| ubsan_epilogue+0x12/0x86 lib/ubsan.c:159 |
| handle_overflow+0x1c2/0x21f lib/ubsan.c:190 |
| __ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198 |
| snd_timer_user_next_device sound/core/timer.c:1524 [inline] |
| __snd_timer_user_ioctl+0x204d/0x2520 sound/core/timer.c:1939 |
| snd_timer_user_ioctl+0x67/0x95 sound/core/timer.c:1994 |
| .... |
| |
| It happens only when a value with INT_MAX is passed, as we're |
| incrementing it unconditionally. So the fix is trivial, check the |
| value with INT_MAX. Although the bug itself is fairly harmless, it's |
| better to fix it so that fuzzers won't hit this again later. |
| |
| Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200213 |
| Reported-and-tested-by: Team OWL337 <icytxw@gmail.com> |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| [bwh: Backported to 3.16: adjust context, indentation] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| sound/core/timer.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/sound/core/timer.c |
| +++ b/sound/core/timer.c |
| @@ -1476,7 +1476,7 @@ static int snd_timer_user_next_device(st |
| } else { |
| if (id.subdevice < 0) { |
| id.subdevice = 0; |
| - } else { |
| + } else if (id.subdevice < INT_MAX) { |
| id.subdevice++; |
| } |
| } |