diff options
| author | Clemens Ladisch <clemens@ladisch.de> | 2010-05-25 09:01:46 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2010-05-25 20:23:48 +0200 |
| commit | b406e6103baa3da85950f22d3d46d21a8da654c5 (patch) | |
| tree | 3b989503e6d5c75795980a0387c35fcd82c13ee0 /sound | |
| parent | 57c7ffc9414d79c8ec25800bbdbf8f801b2f148a (diff) | |
| download | linux-3.10-b406e6103baa3da85950f22d3d46d21a8da654c5.tar.gz linux-3.10-b406e6103baa3da85950f22d3d46d21a8da654c5.tar.bz2 linux-3.10-b406e6103baa3da85950f22d3d46d21a8da654c5.zip | |
ALSA: pcm: fix delta calculation at boundary wraparound
In the cleanup of the hw_ptr update functions in 2.6.33, the calculation
of the delta value was changed to use the modulo operator to protect
against a negative difference due to the pointer wrapping around at the
boundary.
However, the ptr variables are unsigned, so a negative difference would
result in the two complement's value which has no relation to the actual
difference relative to the boundary; the result is typically some value
near LONG_MAX-boundary. Furthermore, even if the modulo operation would
be done with signed types, the result of a negative dividend could be
negative.
The invalid delta value is then caught by the following checks, but this
means that the pointer update is ignored.
To fix this, use a range check as in the other pointer calculations.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/core/pcm_lib.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c index 22aff180dd1..e9d98be190c 100644 --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -345,7 +345,9 @@ static int snd_pcm_update_hw_ptr0(struct snd_pcm_substream *substream, new_hw_ptr = hw_base + pos; } __delta: - delta = (new_hw_ptr - old_hw_ptr) % runtime->boundary; + delta = new_hw_ptr - old_hw_ptr; + if (delta < 0) + delta += runtime->boundary; if (xrun_debug(substream, in_interrupt ? XRUN_DEBUG_PERIODUPDATE : XRUN_DEBUG_HWPTRUPDATE)) { char name[16]; |