At Sat, 18 Aug 2012 18:55:15 +0300, Dan Carpenter wrote:

Speed comes from get_user() in audio_ioctl(). We use it to set the "s" variable before clamping it to valid values so it could lead to a divide by zero bug.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Thanks, applied now. Takashi

diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c index 733b014..b2b3c01 100644 --- a/sound/oss/sb_audio.c +++ b/sound/oss/sb_audio.c @@ -575,13 +575,15 @@ static int jazz16_audio_set_speed(int dev, int speed) if (speed > 0) { int tmp; - int s = speed * devc->channels; + int s;

if (speed < 5000) speed = 5000; if (speed > 44100) speed = 44100;

+ s = speed * devc->channels; + devc->tconst = (256 - ((1000000 + s / 2) / s)) & 0xff;

tmp = 256 - devc->tconst;