| Message ID | 1320234974-15318-1-git-send-email-kraxel@redhat.com |
|---|---|
| State | New |
| Headers | show |
Gerd Hoffmann <kraxel@redhat.com> writes: > commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug: > The stream-not-found case doesn't error out any more, instead the > code silently uses the first stream. Fix it. > > Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
Am 02.11.2011 12:56, schrieb Gerd Hoffmann: > commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug: > The stream-not-found case doesn't error out any more, instead the > code silently uses the first stream. Fix it. > > Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> > --- > hw/intel-hda.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/hw/intel-hda.c b/hw/intel-hda.c > index 675b659..b7ec36d 100644 > --- a/hw/intel-hda.c > +++ b/hw/intel-hda.c > @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, > break; > } > } > - if (st == NULL) { > + if (s == 4) { > return false; > } > if (st->bpl == NULL) { The commit message doesn't say it clearly: Is st == NULL impossible? If not, this introduces a potential NULL pointer dereference at st->bpl. Andreas
Am 02.11.2011 13:18, schrieb Andreas Färber: > Am 02.11.2011 12:56, schrieb Gerd Hoffmann: >> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug: >> The stream-not-found case doesn't error out any more, instead the >> code silently uses the first stream. Fix it. >> >> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> >> --- >> hw/intel-hda.c | 2 +- >> 1 files changed, 1 insertions(+), 1 deletions(-) >> >> diff --git a/hw/intel-hda.c b/hw/intel-hda.c >> index 675b659..b7ec36d 100644 >> --- a/hw/intel-hda.c >> +++ b/hw/intel-hda.c >> @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, >> break; >> } >> } >> - if (st == NULL) { >> + if (s == 4) { >> return false; >> } >> if (st->bpl == NULL) { > > The commit message doesn't say it clearly: Is st == NULL impossible? > If not, this introduces a potential NULL pointer dereference at st->bpl. Yes, it's impossible. This is the full context: st = output ? d->st + 4 : d->st; for (s = 0; s < 4; s++) { if (stnr == ((st[s].ctl >> 20) & 0x0f)) { st = st + s; break; } } d->st is an array: IntelHDAStream st[8]; Kevin
On 11/02/2011 06:56 AM, Gerd Hoffmann wrote: > commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug: > The stream-not-found case doesn't error out any more, instead the > code silently uses the first stream. Fix it. > > Signed-off-by: Gerd Hoffmann<kraxel@redhat.com> Applied. Thanks. Regards, Anthony Liguori > --- > hw/intel-hda.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/hw/intel-hda.c b/hw/intel-hda.c > index 675b659..b7ec36d 100644 > --- a/hw/intel-hda.c > +++ b/hw/intel-hda.c > @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, > break; > } > } > - if (st == NULL) { > + if (s == 4) { > return false; > } > if (st->bpl == NULL) {
diff --git a/hw/intel-hda.c b/hw/intel-hda.c index 675b659..b7ec36d 100644 --- a/hw/intel-hda.c +++ b/hw/intel-hda.c @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, break; } } - if (st == NULL) { + if (s == 4) { return false; } if (st->bpl == NULL) {
commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug: The stream-not-found case doesn't error out any more, instead the code silently uses the first stream. Fix it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> --- hw/intel-hda.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)