From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DCD7C46467 for ; Mon, 7 Feb 2022 11:30:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1384101AbiBGLYo (ORCPT ); Mon, 7 Feb 2022 06:24:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1382378AbiBGLTB (ORCPT ); Mon, 7 Feb 2022 06:19:01 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDB05C0401C3; Mon, 7 Feb 2022 03:18:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 31092B8111C; Mon, 7 Feb 2022 11:18:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 74D1FC004E1; Mon, 7 Feb 2022 11:18:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232735; bh=SeRPt0Q98nfh9FsG1mrvShNaWyOUqkOPAtPUaS5DPVE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oopxCqp1XG8PaM+DwyygOx2PKq30NNEGnp7ouP4LiUDzHVv6EiR2DrhHLhB6/R5v9 kLLD4S9eBaq2AOkU88jOCXxo5I7+hB5TbkBD9kZwNvsHNP0cBYaNgyqyRXr7eauARj UBU6tBxX/HPJjec98HX5G7+yVezVMBo5O9Lmka1M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown Subject: [PATCH 5.4 02/44] ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() Date: Mon, 7 Feb 2022 12:06:18 +0100 Message-Id: <20220207103753.234226016@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103753.155627314@linuxfoundation.org> References: <20220207103753.155627314@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mark Brown commit 817f7c9335ec01e0f5e8caffc4f1dcd5e458a4c0 upstream. We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range. Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220124153253.3548853-2-broonie@kernel.org Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman --- sound/soc/soc-ops.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -322,13 +322,27 @@ int snd_soc_put_volsw(struct snd_kcontro if (sign_bit) mask = BIT(sign_bit + 1) - 1; - val = ((ucontrol->value.integer.value[0] + min) & mask); + val = ucontrol->value.integer.value[0]; + if (mc->platform_max && val > mc->platform_max) + return -EINVAL; + if (val > max - min) + return -EINVAL; + if (val < 0) + return -EINVAL; + val = (val + min) & mask; if (invert) val = max - val; val_mask = mask << shift; val = val << shift; if (snd_soc_volsw_is_stereo(mc)) { - val2 = ((ucontrol->value.integer.value[1] + min) & mask); + val2 = ucontrol->value.integer.value[1]; + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max - min) + return -EINVAL; + if (val2 < 0) + return -EINVAL; + val2 = (val2 + min) & mask; if (invert) val2 = max - val2; if (reg == reg2) {