linux-kernel - Re: [PATCH] fix incorrect test in trident_ac97

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 07 Nov 2007 19:50:21 +0100
From:	Roel Kluin <12o3l@...cali.nl>
To:	Ray Lee <ray-lk@...rabbit.org>
CC:	lkml <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] fix incorrect test in trident_ac97_set(); sound/oss/trident.c

Ray Lee wrote:
> On Nov 7, 2007 10:34 AM, Roel Kluin <12o3l@...cali.nl> wrote:
>> If count reaches zero, the loop ends, but the postfix decrement subtracts it.
>> so, testing for 'count == 0' will not work.
>>
>> Signed-off-by: Roel Kluin <12o3l@...cali.nl>
>> ---
>> diff --git a/sound/oss/trident.c b/sound/oss/trident.c
>> index 96adc47..94b5fb4 100644
>> --- a/sound/oss/trident.c
>> +++ b/sound/oss/trident.c
>> @@ -2939,7 +2939,7 @@ trident_ac97_set(struct ac97_codec *codec, u8 reg, u16 val)
>>
>>         data |= (mask | (reg & AC97_REG_ADDR));
>>
>> -       if (count == 0) {
>> +       if (count == -1) {
>>                 printk(KERN_ERR "trident: AC97 CODEC write timed out.\n");
>>                 spin_unlock_irqrestore(&card->lock, flags);
>>                 return;
>> @@ -2999,7 +2999,7 @@ trident_ac97_get(struct ac97_codec *codec, u8 reg)
>>         } while (count--);
>>         spin_unlock_irqrestore(&card->lock, flags);
>>
>> -       if (count == 0) {
>> +       if (count == -1) {
>>                 printk(KERN_ERR "trident: AC97 CODEC read timed out.\n");
>>                 data = 0;
>>         }
> 
> You didn't test this: count is unsigned. Change the loop condition to
> be --count instead.
> 
> Ray

Yep, you're right, here:
--
If count reaches zero, the loop ends, but the postfix decrement still subtracts:
testing for 'count == 0' will not work.

Signed-off-by: Roel Kluin <12o3l@...cali.nl>
---
diff --git a/sound/oss/trident.c b/sound/oss/trident.c
index 96adc47..6959ee1 100644
--- a/sound/oss/trident.c
+++ b/sound/oss/trident.c
@@ -2935,7 +2935,7 @@ trident_ac97_set(struct ac97_codec *codec, u8 reg, u16 val)
 	do {
 		if ((inw(TRID_REG(card, address)) & busy) == 0)
 			break;
-	} while (count--);
+	} while (--count);
 
 	data |= (mask | (reg & AC97_REG_ADDR));
 
@@ -2996,7 +2996,7 @@ trident_ac97_get(struct ac97_codec *codec, u8 reg)
 		data = inl(TRID_REG(card, address));
 		if ((data & busy) == 0)
 			break;
-	} while (count--);
+	} while (--count);
 	spin_unlock_irqrestore(&card->lock, flags);
 
 	if (count == 0) {
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/