From patchwork Fri Nov 25 15:48:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Charles Keepax X-Patchwork-Id: 628575 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5D71BC4332F for ; Fri, 25 Nov 2022 15:49:41 +0000 (UTC) Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id 65A3A1734; Fri, 25 Nov 2022 16:48:49 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz 65A3A1734 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1669391379; bh=jhyI7Tti8iFccb1SBBidKLV74lIRKqerjW3LSv0ReWk=; h=From:To:Subject:Date:In-Reply-To:References:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=T5c8/yPx/Y/h4ygyFgXu0J2gPb1ak68HQsW5diLi4XbLOFPOp0DSpXvpFI+MBKxS5 xQcoM04uas1LiNxSUkgmJ2/qD41O6vm+eswqWIY6XWXhE04DkOD3joJyCIuGl9BN5f miTumdVnkBz5/Ku3BeLs/gt2Myyc9+cDdMjaEIqg= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id 15259F800F4; Fri, 25 Nov 2022 16:48:49 +0100 (CET) Received: by alsa1.perex.cz (Postfix, from userid 50401) id 69FBAF804C2; Fri, 25 Nov 2022 16:48:47 +0100 (CET) Received: from mx0b-001ae601.pphosted.com (mx0b-001ae601.pphosted.com [67.231.152.168]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 7BFF7F8014E for ; Fri, 25 Nov 2022 16:48:41 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 7BFF7F8014E Authentication-Results: alsa1.perex.cz; dkim=pass (2048-bit key) header.d=cirrus.com header.i=@cirrus.com header.b="L4RulWX0" Received: from pps.filterd (m0077474.ppops.net [127.0.0.1]) by mx0b-001ae601.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 2APAeIZH029176; Fri, 25 Nov 2022 09:48:40 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cirrus.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=PODMain02222019; bh=uW/WpNmmC7tC7iQ8OZIjE3xzDFP6uUHt4byQTyCpPoI=; b=L4RulWX03DXmAp7H8eghaaI2AZB3dR3EX7n7j1iKIIgJ+5SzKChDqnlKCG/KWsNdJC06 oXS/0dbjBdipymOkWPrs9OF58BxTo8AUsoZdR8T0FMudqUknYzYVgu91rqZz9QPYE/Yf oc1z1DjaNUxOlJNwo7r4vFB1+0kU/HsXrI3UrwqhDqkHzHLGIiC7cQP3hQVzz1OrNDIp /9/5VauuUbi/vFjDQndBIBqkj5CMIxLX3TxFNk2vKJhKPgv3NR3kQRLP6C+sDF4dJrKr ph/cNrTsZXz18isdhpW0Np4YGToS0vmf8Syl5akaDjNrG3Kr/FG92sGxRY4ZQwytEHxt KQ== Received: from ediex02.ad.cirrus.com ([84.19.233.68]) by mx0b-001ae601.pphosted.com (PPS) with ESMTPS id 3kxvet7f2v-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 25 Nov 2022 09:48:39 -0600 Received: from ediex01.ad.cirrus.com (198.61.84.80) by ediex02.ad.cirrus.com (198.61.84.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.20; Fri, 25 Nov 2022 09:48:37 -0600 Received: from ediswmail.ad.cirrus.com (198.61.86.93) by ediex01.ad.cirrus.com (198.61.84.80) with Microsoft SMTP Server id 15.2.1118.20 via Frontend Transport; Fri, 25 Nov 2022 09:48:37 -0600 Received: from algalon.ad.cirrus.com (algalon.ad.cirrus.com [198.90.251.122]) by ediswmail.ad.cirrus.com (Postfix) with ESMTP id C4C4E2BA; Fri, 25 Nov 2022 15:48:37 +0000 (UTC) From: Charles Keepax To: Subject: [PATCH 2/2] ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() Date: Fri, 25 Nov 2022 15:48:37 +0000 Message-ID: <20221125154837.1270501-3-ckeepax@opensource.cirrus.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20221125154837.1270501-1-ckeepax@opensource.cirrus.com> References: <20221125154837.1270501-1-ckeepax@opensource.cirrus.com> MIME-Version: 1.0 X-Proofpoint-ORIG-GUID: DoyPQfFDUzIbyFo8XgGVz_FFqTZV9Wj5 X-Proofpoint-GUID: DoyPQfFDUzIbyFo8XgGVz_FFqTZV9Wj5 X-Proofpoint-Spam-Reason: safe Cc: patches@opensource.cirrus.com, alsa-devel@alsa-project.org, guille.rodriguez@gmail.com, lgirdwood@gmail.com X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" From: Mark Brown The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks. Signed-off-by: Mark Brown Signed-off-by: Charles Keepax --- Slight fixup was made over your original version to make the check of val2 > max be without the min and mask applied. Thanks, Charles sound/soc/soc-ops.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 47691119306fb..55b009d3c6815 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -464,10 +464,15 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, ret = err; if (snd_soc_volsw_is_stereo(mc)) { - unsigned int val2; + unsigned int val2 = ucontrol->value.integer.value[1]; + + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max) + return -EINVAL; val_mask = mask << rshift; - val2 = (ucontrol->value.integer.value[1] + min) & mask; + val2 = (val2 + min) & mask; val2 = val2 << rshift; err = snd_soc_component_update_bits(component, reg2, val_mask,