From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Takashi Iwai <tiwai@suse.de>
Subject: [PATCH 5.10 08/16] ALSA: usb-audio: Fix control access overflow errors from chmap
Date: Sat, 19 Dec 2020 13:57:15 +0100 [thread overview]
Message-ID: <20201219125339.481030019@linuxfoundation.org> (raw)
In-Reply-To: <20201219125339.066340030@linuxfoundation.org>
From: Takashi Iwai <tiwai@suse.de>
commit c6dde8ffd071aea9d1ce64279178e470977b235c upstream.
The current channel-map control implementation in USB-audio driver may
lead to an error message like
"control 3:0:0:Playback Channel Map:0: access overflow"
when CONFIG_SND_CTL_VALIDATION is set. It's because the chmap get
callback clears the whole array no matter which count is set, and
rather the false-positive detection.
This patch fixes the problem by clearing only the needed array range
at usb_chmap_ctl_get().
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201211130048.6358-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/stream.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -193,16 +193,16 @@ static int usb_chmap_ctl_get(struct snd_
struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
struct snd_usb_substream *subs = info->private_data;
struct snd_pcm_chmap_elem *chmap = NULL;
- int i;
+ int i = 0;
- memset(ucontrol->value.integer.value, 0,
- sizeof(ucontrol->value.integer.value));
if (subs->cur_audiofmt)
chmap = subs->cur_audiofmt->chmap;
if (chmap) {
for (i = 0; i < chmap->channels; i++)
ucontrol->value.integer.value[i] = chmap->map[i];
}
+ for (; i < subs->channels_max; i++)
+ ucontrol->value.integer.value[i] = 0;
return 0;
}
next prev parent reply other threads:[~2020-12-19 12:57 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-19 12:57 [PATCH 5.10 00/16] 5.10.2-rc1 review Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 01/16] ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info() Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 02/16] ktest.pl: If size of log is too big to email, email error message Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 03/16] ktest.pl: Fix the logic for truncating the size of the log file for email Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 04/16] USB: legotower: fix logical error in recent commit Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 05/16] USB: dummy-hcd: Fix uninitialized array use in init() Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 06/16] USB: add RESET_RESUME quirk for Snapscan 1212 Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 07/16] ALSA: usb-audio: Fix potential out-of-bounds shift Greg Kroah-Hartman
2020-12-19 12:57 ` Greg Kroah-Hartman [this message]
2020-12-19 12:57 ` [PATCH 5.10 09/16] xhci: Give USB2 ports time to enter U3 in bus suspend Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 10/16] usb: xhci: Set quirk for XHCI_SG_TRB_CACHE_SIZE_QUIRK Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 11/16] xhci-pci: Allow host runtime PM as default for Intel Alpine Ridge LP Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 12/16] xhci-pci: Allow host runtime PM as default for Intel Maple Ridge xHCI Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 13/16] USB: UAS: introduce a quirk to set no_write_same Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 14/16] USB: sisusbvga: Make console support depend on BROKEN Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 15/16] ALSA: pcm: oss: Fix potential out-of-bounds shift Greg Kroah-Hartman
2020-12-19 12:57 ` [PATCH 5.10 16/16] serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access Greg Kroah-Hartman
2020-12-19 21:20 ` [PATCH 5.10 00/16] 5.10.2-rc1 review Jeffrin Jose T
2020-12-19 21:50 ` Guenter Roeck
2020-12-21 12:59 ` Greg Kroah-Hartman
2020-12-20 3:17 ` Naresh Kamboju
2020-12-21 12:59 ` Greg Kroah-Hartman
2020-12-20 13:41 ` Jon Hunter
2020-12-21 13:00 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201219125339.481030019@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.