| From 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a Mon Sep 17 00:00:00 2001 |
| From: Takashi Iwai <tiwai@suse.de> |
| Date: Tue, 7 Apr 2020 10:44:01 +0200 |
| Subject: ALSA: hda: Fix potential access overflow in beep helper |
| |
| From: Takashi Iwai <tiwai@suse.de> |
| |
| commit 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a upstream. |
| |
| The beep control helper function blindly stores the values in two |
| stereo channels no matter whether the actual control is mono or |
| stereo. This is practically harmless, but it annoys the recently |
| introduced sanity check, resulting in an error when the checker is |
| enabled. |
| |
| This patch corrects the behavior to store only on the defined array |
| member. |
| |
| Fixes: 0401e8548eac ("ALSA: hda - Move beep helper functions to hda_beep.c") |
| BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207139 |
| Reviewed-by: Jaroslav Kysela <perex@perex.cz> |
| Cc: <stable@vger.kernel.org> |
| Link: https://lore.kernel.org/r/20200407084402.25589-2-tiwai@suse.de |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| sound/pci/hda/hda_beep.c | 6 +++++- |
| 1 file changed, 5 insertions(+), 1 deletion(-) |
| |
| --- a/sound/pci/hda/hda_beep.c |
| +++ b/sound/pci/hda/hda_beep.c |
| @@ -297,8 +297,12 @@ int snd_hda_mixer_amp_switch_get_beep(st |
| { |
| struct hda_codec *codec = snd_kcontrol_chip(kcontrol); |
| struct hda_beep *beep = codec->beep; |
| + int chs = get_amp_channels(kcontrol); |
| + |
| if (beep && (!beep->enabled || !ctl_has_mute(kcontrol))) { |
| - ucontrol->value.integer.value[0] = |
| + if (chs & 1) |
| + ucontrol->value.integer.value[0] = beep->enabled; |
| + if (chs & 2) |
| ucontrol->value.integer.value[1] = beep->enabled; |
| return 0; |
| } |
