| From ac902c112d90a89e59916f751c2745f4dbdbb4bd Mon Sep 17 00:00:00 2001 |
| From: Lars-Peter Clausen <lars@metafoo.de> |
| Date: Wed, 18 Jun 2014 13:32:34 +0200 |
| Subject: ALSA: control: Handle numid overflow |
| |
| From: Lars-Peter Clausen <lars@metafoo.de> |
| |
| commit ac902c112d90a89e59916f751c2745f4dbdbb4bd upstream. |
| |
| Each control gets automatically assigned its numids when the control is created. |
| The allocation is done by incrementing the numid by the amount of allocated |
| numids per allocation. This means that excessive creation and destruction of |
| controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to |
| eventually overflow. Currently when this happens for the control that caused the |
| overflow kctl->id.numid + kctl->count will also over flow causing it to be |
| smaller than kctl->id.numid. Most of the code assumes that this is something |
| that can not happen, so we need to make sure that it won't happen |
| |
| Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> |
| Acked-by: Jaroslav Kysela <perex@perex.cz> |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| sound/core/control.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| --- a/sound/core/control.c |
| +++ b/sound/core/control.c |
| @@ -288,6 +288,10 @@ static bool snd_ctl_remove_numid_conflic |
| { |
| struct snd_kcontrol *kctl; |
| |
| + /* Make sure that the ids assigned to the control do not wrap around */ |
| + if (card->last_numid >= UINT_MAX - count) |
| + card->last_numid = 0; |
| + |
| list_for_each_entry(kctl, &card->controls, list) { |
| if (kctl->id.numid < card->last_numid + 1 + count && |
| kctl->id.numid + kctl->count > card->last_numid + 1) { |