Commit 60a50539 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jiri Slaby

ALSA: off by one bug in snd_riptide_joystick_probe()

commit e4940626 upstream.

The problem here is that we check:

	if (dev >= SNDRV_CARDS)

Then we increment "dev".

       if (!joystick_port[dev++])

Then we use it as an offset into a array with SNDRV_CARDS elements.

	if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {

This has 3 effects:
1) If you use the module option to specify the joystick port then it has
   to be shifted one space over.
2) The wrong error message will be printed on failure if you have over
   32 cards.
3) Static checkers will correctly complain that are off by one.

Fixes: db1005ec ('ALSA: riptide - Fix joystick resource handling')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
parent 63935f3d
...@@ -2032,32 +2032,43 @@ snd_riptide_joystick_probe(struct pci_dev *pci, const struct pci_device_id *id) ...@@ -2032,32 +2032,43 @@ snd_riptide_joystick_probe(struct pci_dev *pci, const struct pci_device_id *id)
{ {
static int dev; static int dev;
struct gameport *gameport; struct gameport *gameport;
int ret;
if (dev >= SNDRV_CARDS) if (dev >= SNDRV_CARDS)
return -ENODEV; return -ENODEV;
if (!enable[dev]) { if (!enable[dev]) {
dev++; ret = -ENOENT;
return -ENOENT; goto inc_dev;
} }
if (!joystick_port[dev++]) if (!joystick_port[dev]) {
return 0; ret = 0;
goto inc_dev;
}
gameport = gameport_allocate_port(); gameport = gameport_allocate_port();
if (!gameport) if (!gameport) {
return -ENOMEM; ret = -ENOMEM;
goto inc_dev;
}
if (!request_region(joystick_port[dev], 8, "Riptide gameport")) { if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
snd_printk(KERN_WARNING snd_printk(KERN_WARNING
"Riptide: cannot grab gameport 0x%x\n", "Riptide: cannot grab gameport 0x%x\n",
joystick_port[dev]); joystick_port[dev]);
gameport_free_port(gameport); gameport_free_port(gameport);
return -EBUSY; ret = -EBUSY;
goto inc_dev;
} }
gameport->io = joystick_port[dev]; gameport->io = joystick_port[dev];
gameport_register_port(gameport); gameport_register_port(gameport);
pci_set_drvdata(pci, gameport); pci_set_drvdata(pci, gameport);
return 0;
ret = 0;
inc_dev:
dev++;
return ret;
} }
static void snd_riptide_joystick_remove(struct pci_dev *pci) static void snd_riptide_joystick_remove(struct pci_dev *pci)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment