| From 817f7c9335ec01e0f5e8caffc4f1dcd5e458a4c0 Mon Sep 17 00:00:00 2001 |
| From: Mark Brown <broonie@kernel.org> |
| Date: Mon, 24 Jan 2022 15:32:51 +0000 |
| Subject: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() |
| |
| From: Mark Brown <broonie@kernel.org> |
| |
| commit 817f7c9335ec01e0f5e8caffc4f1dcd5e458a4c0 upstream. |
| |
| We don't currently validate that the values being set are within the range |
| we advertised to userspace as being valid, do so and reject any values |
| that are out of range. |
| |
| Signed-off-by: Mark Brown <broonie@kernel.org> |
| Cc: stable@vger.kernel.org |
| Link: https://lore.kernel.org/r/20220124153253.3548853-2-broonie@kernel.org |
| Signed-off-by: Mark Brown <broonie@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| sound/soc/soc-ops.c | 18 ++++++++++++++++-- |
| 1 file changed, 16 insertions(+), 2 deletions(-) |
| |
| --- a/sound/soc/soc-ops.c |
| +++ b/sound/soc/soc-ops.c |
| @@ -316,13 +316,27 @@ int snd_soc_put_volsw(struct snd_kcontro |
| if (sign_bit) |
| mask = BIT(sign_bit + 1) - 1; |
| |
| - val = ((ucontrol->value.integer.value[0] + min) & mask); |
| + val = ucontrol->value.integer.value[0]; |
| + if (mc->platform_max && val > mc->platform_max) |
| + return -EINVAL; |
| + if (val > max - min) |
| + return -EINVAL; |
| + if (val < 0) |
| + return -EINVAL; |
| + val = (val + min) & mask; |
| if (invert) |
| val = max - val; |
| val_mask = mask << shift; |
| val = val << shift; |
| if (snd_soc_volsw_is_stereo(mc)) { |
| - val2 = ((ucontrol->value.integer.value[1] + min) & mask); |
| + val2 = ucontrol->value.integer.value[1]; |
| + if (mc->platform_max && val2 > mc->platform_max) |
| + return -EINVAL; |
| + if (val2 > max - min) |
| + return -EINVAL; |
| + if (val2 < 0) |
| + return -EINVAL; |
| + val2 = (val2 + min) & mask; |
| if (invert) |
| val2 = max - val2; |
| if (reg == reg2) { |
