linux-kernel - Re: [PATCH v2] ALSA: usb-audio: scarlett2: Fix for loop increment in scarlett2_usb_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YNY3oF3RkbZRk2Ri@Ryzen-9-3900X.localdomain>
Date:   Fri, 25 Jun 2021 13:08:00 -0700
From:   Nathan Chancellor <nathan@...nel.org>
To:     "Geoffrey D. Bennett" <g@...vu>
Cc:     alsa-devel@...a-project.org,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        linux-kernel@...r.kernel.org, Takashi Iwai <tiwai@...e.com>,
        clang-built-linux@...glegroups.com
Subject: Re: [PATCH v2] ALSA: usb-audio: scarlett2: Fix for loop increment in
 scarlett2_usb_get_config

On Sat, Jun 26, 2021 at 04:13:42AM +0930, Geoffrey D. Bennett wrote:
> On Fri, Jun 25, 2021 at 10:54:19AM -0700, Nathan Chancellor wrote:
> > Clang warns:
> > 
> > sound/usb/mixer_scarlett_gen2.c:1189:32: warning: expression result
> > unused [-Wunused-value]
> >                         for (i = 0; i < count; i++, (u16 *)buf++)
> >                                                     ^      ~~~~~
> > 1 warning generated.
> > 
> > It appears the intention was to cast the void pointer to a u16 pointer
> > so that the data could be iterated through like an array of u16 values.
> > However, the cast happens after the increment because a cast is an
> > rvalue, whereas the post-increment operator only works on lvalues, so
> > the loop does not iterate as expected. This is not a bug in practice
> > because count is not greater than one at the moment but this could
> > change in the future so this should be fixed.
> > 
> > Replace the cast with a temporary variable of the proper type, which is
> > less error prone and fixes the iteration. Do the same thing for the
> > 'u8 *' below this if block.
> > 
> > Fixes: ac34df733d2d ("ALSA: usb-audio: scarlett2: Update get_config to do endian conversion")
> > Link: https://github.com/ClangBuiltLinux/linux/issues/1408
> > Signed-off-by: Nathan Chancellor <nathan@...nel.org>
> > ---
> > 
> > v1 -> v2:
> > 
> > * Use temporary variables of proper type rather than casting, as
> >   requested by Takashi. I did not include Geoffrey's ack for this
> >   reason.
> > 
> > * Mention that there is not a bug at the moment per Geoffrey's comment.
> > 
> >  sound/usb/mixer_scarlett_gen2.c | 14 ++++++++++----
> >  1 file changed, 10 insertions(+), 4 deletions(-)
> > 
> > diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
> > index fcba682cd422..b13903bed330 100644
> > --- a/sound/usb/mixer_scarlett_gen2.c
> > +++ b/sound/usb/mixer_scarlett_gen2.c
> > @@ -1177,17 +1177,22 @@ static int scarlett2_usb_get_config(
> >  	const struct scarlett2_config *config_item =
> >  		&scarlett2_config_items[info->has_mixer][config_item_num];
> >  	int size, err, i;
> > +	u8 *buf_8;
> >  	u8 value;
> >  
> >  	/* For byte-sized parameters, retrieve directly into buf */
> >  	if (config_item->size >= 8) {
> > +		u16 *buf_16;
> > +
> 
> I would prefer that the u16 *buf_16 declaration above be removed from
> there...
> 
> >  		size = config_item->size / 8 * count;
> >  		err = scarlett2_usb_get(mixer, config_item->offset, buf, size);
> >  		if (err < 0)
> >  			return err;
> > -		if (size == 2)
> > -			for (i = 0; i < count; i++, (u16 *)buf++)
> > -				*(u16 *)buf = le16_to_cpu(*(__le16 *)buf);
> > +		if (size == 2) {
> > +			buf_16 = buf;
> 
> ...and combined with the assignment here, like: u16 *buf_16 = buf;

Thanks for pointing it out, I was not paying enough attention to realize
that the scope could be reduced. v3 sent with your Ack added, thank you
for taking a look in a quick manner!

Cheers,
Nathan

> Regardless:
> 
> Acked-by: Geoffrey D. Bennett <g@...vu>
> 
> And, thanks again!
> 
> > +			for (i = 0; i < count; i++, buf_16++)
> > +				*buf_16 = le16_to_cpu(*(__le16 *)buf_16);
> > +		}
> >  		return 0;
> >  	}
> >  
> > @@ -1197,8 +1202,9 @@ static int scarlett2_usb_get_config(
> >  		return err;
> >  
> >  	/* then unpack from value into buf[] */
> > +	buf_8 = buf;
> >  	for (i = 0; i < 8 && i < count; i++, value >>= 1)
> > -		*(u8 *)buf++ = value & 1;
> > +		*buf_8++ = value & 1;
> >  
> >  	return 0;
> >  }
> > 
> > base-commit: 0cbbeaf370221fc469c95945dd3c1198865c5fe4
> > -- 
> > 2.32.0.93.g670b81a890
> >