FAILED: patch "[PATCH] ALSA: wavefront: Fix integer overflow in sample size" failed to apply to 6.6-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 0c4a13ba88594fd4a27292853e736c6b4349823d
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025121615-subplot-parachute-73bb@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 0c4a13ba88594fd4a27292853e736c6b4349823d Mon Sep 17 00:00:00 2001
From: Junrui Luo <[email protected]>
Date: Thu, 6 Nov 2025 10:49:46 +0800
Subject: [PATCH] ALSA: wavefront: Fix integer overflow in sample size
validation
The wavefront_send_sample() function has an integer overflow issue when validating sample size. The header->size field is u32 but gets cast to int for comparison with dev->freemem
Fix by using unsigned comparison to avoid integer overflow.
sound/isa/wavefront/wavefront_synth.c +2 -2
@@ -950,9 +950,9 @@ wavefront_send_sample (snd_wavefront_t *dev,if (header->size) { dev->freemem =wavefront_freemem (dev); -if (dev->freemem < (int )header->size) { +if (dev->freemem <0 || dev->freemem < header->size) {dev_err (dev->card->dev, -"insufficient memory to load %d byte sample.\n" , +"insufficient memory to load %u byte sample.\n" , header->size);return -ENOMEM ; }
Sasha Levin
maintainerPATCH 1/2 ALSA: wavefront: Use standard print API
From: Takashi Iwai <[email protected]>
[ Upstream commit 8b4ac5429938dd5f1fbf2eea0687f08cbcccb6be ]
Use the standard print API with dev_*() instead of the old house-baked one. It gives better information and allows dynamically control of debug prints.
Stable-dep-of: 0c4a13ba8859 ("ALSA: wavefront: Fix integer overflow in sample size validation")
--- include/sound/snd_wavefront.h | 4 - sound/isa/wavefront/wavefront.c | 61 ++++---- sound/isa/wavefront/wavefront_fx.c | 36 ++--- sound/isa/wavefront/wavefront_midi.c | 15 +- sound/isa/wavefront/wavefront_synth.c | 196 +++++++++++++------------- 5 files changed, 158 insertions(+), 154 deletions(-)
include/sound/snd_wavefront.h +0 -4
@@ -137,8 +137,4 @@ extern int snd_wavefront_fx_ioctl (struct snd_hwdep *,extern int snd_wavefront_fx_open (struct snd_hwdep *,struct file *);extern int snd_wavefront_fx_release (struct snd_hwdep *,struct file *); -/* prefix in all snd_printk() delivered messages */ - -#define LOGNAME "WaveFront: " -#endif /* __SOUND_SND_WAVEFRONT_H__ */
sound/isa/wavefront/wavefront.c +31 -30
173 lines not on this page · raw message
sound/isa/wavefront/wavefront_fx.c +18 -18
@@ -38,7 +38,7 @@ wavefront_fx_idle (snd_wavefront_t *dev) }if (x &0x80 ) { -snd_printk ("FX device never idle.\n" ); +dev_err (dev->card->dev,"FX device never idle.\n" );return 0 ; }
@@ -64,14 +64,14 @@ wavefront_fx_memset (snd_wavefront_t *dev, unsigned short *data) {if (page <0 || page >7 ) { -snd_printk ("FX memset: " -"page must be >= 0 and <= 7\n" ); +dev_err (dev->card->dev, +"FX memset: page must be >= 0 and <= 7\n" );return -EINVAL ; }if (addr <0 || addr >0x7f ) { -snd_printk ("FX memset: " -"addr must be >= 0 and <= 7f\n" ); +dev_err (dev->card->dev, +"FX memset: addr must be >= 0 and <= 7f\n" );return -EINVAL ; }
@@ -83,7 +83,7 @@ wavefront_fx_memset (snd_wavefront_t *dev,outb ((data[0 ] >>8 ), dev->fx_dsp_msb);outb ((data[0 ] &0xff ), dev->fx_dsp_lsb); -snd_printk ("FX: addr %d:%x set to 0x%x\n" , +dev_err (dev->card->dev,"FX: addr %d:%x set to 0x%x\n" , page, addr, data[0 ]); }else {
@@ -102,9 +102,9 @@ wavefront_fx_memset (snd_wavefront_t *dev, }if (i != cnt) { -snd_printk ("FX memset " -"(0x%x, 0x%x, 0x%lx, %d) incomplete\n" , - page, addr, (unsigned long ) data, cnt); +dev_err (dev->card->dev, +"FX memset (0x%x, 0x%x, 0x%lx, %d) incomplete\n" , + page, addr, (unsigned long ) data, cnt);return -EIO ; } }
@@ -123,7 +123,7 @@ snd_wavefront_fx_detect (snd_wavefront_t *dev)*/ if (inb (dev->fx_status) &0x80 ) { -snd_printk ("Hmm, probably a Maui or Tropez.\n" ); +dev_err (dev->card->dev,"Hmm, probably a Maui or Tropez.\n" );return -1 ; }
@@ -180,15 +180,15 @@ snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file,case WFFX_MEMSET :if (r.data[2 ] <=0 ) { -snd_printk ("cannot write " -"<= 0 bytes to FX\n" ); +dev_err (dev->card->dev, +"cannot write <= 0 bytes to FX\n" );return -EIO ; }else if (r.data[2 ] ==1 ) { pd = (unsigned short *) &r.data[3 ]; }else {if (r.data[2 ] >256 ) { -snd_printk ("cannot write " -"> 512 bytes to FX\n" ); +dev_err (dev->card->dev, +"cannot write > 512 bytes to FX\n" );return -EIO ; } page_data = memdup_user((unsigned char __user *)
@@ -208,8 +208,8 @@ snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file,break ;default : -snd_printk ("FX: ioctl %d not yet supported\n" , - r.request); +dev_err (dev->card->dev,"FX: ioctl %d not yet supported\n" , + r.request);return -ENOTTY ; }return err;
@@ -254,8 +254,8 @@ snd_wavefront_fx_start (snd_wavefront_t *dev) goto out; } }else { -snd_printk (KERN_ERR "invalid address" -" in register data\n" ); +dev_err (dev->card->dev, +"invalid address in register data\n" ); err =-1 ; goto out; }
sound/isa/wavefront/wavefront_midi.c +10 -5
@@ -501,7 +501,8 @@ snd_wavefront_midi_start (snd_wavefront_card_t *card)for (i =0 ; i <30000 && !output_ready (midi); i++);if (!output_ready (midi)) { -snd_printk ("MIDI interface not ready for command\n" ); +dev_err (card->wavefront.card->dev, +"MIDI interface not ready for command\n" );return -1 ; }
@@ -523,7 +524,8 @@ snd_wavefront_midi_start (snd_wavefront_card_t *card) }if (!ok) { -snd_printk ("cannot set UART mode for MIDI interface" ); +dev_err (card->wavefront.card->dev, +"cannot set UART mode for MIDI interface" ); dev->interrupts_are_midi =0 ;return -1 ; }
@@ -531,7 +533,8 @@ snd_wavefront_midi_start (snd_wavefront_card_t *card)/* Route external MIDI to WaveFront synth (by default) */ if (snd_wavefront_cmd (dev,WFC_MISYNTH_ON , rbuf, wbuf)) { -snd_printk ("can't enable MIDI-IN-2-synth routing.\n" ); +dev_warn (card->wavefront.card->dev, +"can't enable MIDI-IN-2-synth routing.\n" );/* XXX error ? */ }
@@ -547,14 +550,16 @@ snd_wavefront_midi_start (snd_wavefront_card_t *card)*/ if (snd_wavefront_cmd (dev,WFC_VMIDI_OFF , rbuf, wbuf)) { -snd_printk ("virtual MIDI mode not disabled\n" ); +dev_warn (card->wavefront.card->dev, +"virtual MIDI mode not disabled\n" );return 0 ;/* We're OK, but missing the external MIDI dev */ }snd_wavefront_midi_enable_virtual (card);if (snd_wavefront_cmd (dev,WFC_VMIDI_ON , rbuf, wbuf)) { -snd_printk ("cannot enable virtual MIDI mode.\n" ); +dev_warn (card->wavefront.card->dev, +"cannot enable virtual MIDI mode.\n" );snd_wavefront_midi_disable_virtual (card); }return 0 ;
sound/isa/wavefront/wavefront_synth.c +99 -97
561 lines not on this page · raw message
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 2/2 ALSA: wavefront: Fix integer overflow in sample size validation
From: Junrui Luo <[email protected]>
[ Upstream commit 0c4a13ba88594fd4a27292853e736c6b4349823d ]
The wavefront_send_sample() function has an integer overflow issue when validating sample size. The header->size field is u32 but gets cast to int for comparison with dev->freemem
Fix by using unsigned comparison to avoid integer overflow.
--- sound/isa/wavefront/wavefront_synth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/isa/wavefront/wavefront_synth.c +2 -2
@@ -950,9 +950,9 @@ wavefront_send_sample (snd_wavefront_t *dev,if (header->size) { dev->freemem =wavefront_freemem (dev); -if (dev->freemem < (int )header->size) { +if (dev->freemem <0 || dev->freemem < header->size) {dev_err (dev->card->dev, -"insufficient memory to load %d byte sample.\n" , +"insufficient memory to load %u byte sample.\n" , header->size);return -ENOMEM ; }
Signature · 1 line
2.51.0