| From 9bdd10d57a8807dba0003af0325191f3cec0f11c Mon Sep 17 00:00:00 2001 |
| From: Marek Vasut <marex@denx.de> |
| Date: Tue, 15 Feb 2022 14:06:45 +0100 |
| Subject: ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min |
| |
| From: Marek Vasut <marex@denx.de> |
| |
| commit 9bdd10d57a8807dba0003af0325191f3cec0f11c upstream. |
| |
| While the $val/$val2 values passed in from userspace are always >= 0 |
| integers, the limits of the control can be signed integers and the $min |
| can be non-zero and less than zero. To correctly validate $val/$val2 |
| against platform_max, add the $min offset to val first. |
| |
| Fixes: 817f7c9335ec0 ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()") |
| Signed-off-by: Marek Vasut <marex@denx.de> |
| Cc: Mark Brown <broonie@kernel.org> |
| Cc: stable@vger.kernel.org |
| Link: https://lore.kernel.org/r/20220215130645.164025-1-marex@denx.de |
| Signed-off-by: Mark Brown <broonie@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| sound/soc/soc-ops.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/sound/soc/soc-ops.c |
| +++ b/sound/soc/soc-ops.c |
| @@ -323,7 +323,7 @@ int snd_soc_put_volsw(struct snd_kcontro |
| mask = BIT(sign_bit + 1) - 1; |
| |
| val = ucontrol->value.integer.value[0]; |
| - if (mc->platform_max && val > mc->platform_max) |
| + if (mc->platform_max && ((int)val + min) > mc->platform_max) |
| return -EINVAL; |
| if (val > max - min) |
| return -EINVAL; |
| @@ -336,7 +336,7 @@ int snd_soc_put_volsw(struct snd_kcontro |
| val = val << shift; |
| if (snd_soc_volsw_is_stereo(mc)) { |
| val2 = ucontrol->value.integer.value[1]; |
| - if (mc->platform_max && val2 > mc->platform_max) |
| + if (mc->platform_max && ((int)val2 + min) > mc->platform_max) |
| return -EINVAL; |
| if (val2 > max - min) |
| return -EINVAL; |