2021-03-18 13:24:30

by Colin King

Subject: [PATCH] ALSA: usb-audio: Fix unintentional sign extension issue

From: Colin Ian King <[email protected]>

The shifting of the u8 integer device by 24 bits to the left will
be promoted to a 32 bit signed int and then sign-extended to a
64 bit unsigned long. In the event that the top bit of device is
set then all then all the upper 32 bits of the unsigned long will
end up as also being set because of the sign-extension. Fix this
by casting device to an unsigned long before the shift.

Addresses-Coverity: ("Unintended sign extension")
Fixes: a07df82c7990 ("ALSA: usb-audio: Add DJM750 to Pioneer mixer quirk")
Signed-off-by: Colin Ian King <[email protected]>
---
sound/usb/mixer_quirks.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 5b77e8140ba6..f13cdfd8bd20 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -2926,7 +2926,7 @@ static int snd_djm_controls_put(struct snd_kcontrol *kctl, struct snd_ctl_elem_v
u8 group = (private_value & SND_DJM_GROUP_MASK) >> SND_DJM_GROUP_SHIFT;
u16 value = elem->value.enumerated.item[0];

- kctl->private_value = ((device << SND_DJM_DEVICE_SHIFT) |
+ kctl->private_value = (((unsigned long)device << SND_DJM_DEVICE_SHIFT) |
(group << SND_DJM_GROUP_SHIFT) |
value);

@@ -2964,7 +2964,7 @@ static int snd_djm_controls_create(struct usb_mixer_interface *mixer,
value = device->controls[i].default_value;
knew.name = device->controls[i].name;
knew.private_value = (
- (device_idx << SND_DJM_DEVICE_SHIFT) |
+ ((unsigned long)device_idx << SND_DJM_DEVICE_SHIFT) |
(i << SND_DJM_GROUP_SHIFT) |
value);
err = snd_djm_controls_update(mixer, device_idx, i, value);
--
2.30.2

2021-03-18 13:27:22

by Takashi Iwai

Subject: Re: [PATCH] ALSA: usb-audio: Fix unintentional sign extension issue

On Thu, 18 Mar 2021 14:20:08 +0100,
Colin King wrote:
>
> From: Colin Ian King <[email protected]>
>
> The shifting of the u8 integer device by 24 bits to the left will
> be promoted to a 32 bit signed int and then sign-extended to a
> 64 bit unsigned long. In the event that the top bit of device is
> set then all then all the upper 32 bits of the unsigned long will
> end up as also being set because of the sign-extension. Fix this
> by casting device to an unsigned long before the shift.
>
> Addresses-Coverity: ("Unintended sign extension")
> Fixes: a07df82c7990 ("ALSA: usb-audio: Add DJM750 to Pioneer mixer quirk")
> Signed-off-by: Colin Ian King <[email protected]>

Thanks, applied now.


Takashi