Commit fbb5b56c authored Nov 01, 2024 by Mark Brown Committed by Heyuan Wang Nov 01, 2024

ASoC: ops: Fix bounds check for _sx controls

stable inclusion
from stable-v5.10.158
commit b50c9641897274c3faef5f95ac852f54b94be2e8
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF8
CVE: CVE-2022-49005

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b50c9641897274c3faef5f95ac852f54b94be2e8



--------------------------------

[ Upstream commit 698813ba ]

For _sx controls the semantics of the max field is not the usual one, max
is the number of steps rather than the maximum value. This means that our
check in snd_soc_put_volsw_sx() needs to just check against the maximum
value.

Fixes: 4f1e50d6 ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()")
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20220511134137.169575-1-broonie@kernel.org


Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Heyuan Wang <wangheyuan2@h-partners.com>

parent 8d917df6

sound/soc/soc-ops.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -432,7 +432,7 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol,
		val = ucontrol->value.integer.value[0];
		if (mc->platform_max && val > mc->platform_max)
		return -EINVAL;
		if (val > max - min)
		if (val > max)
		return -EINVAL;
		if (val < 0)
		return -EINVAL;