4.14-stable patches

added patches:
	asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch

diff --git a/queue-4.14/asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch b/queue-4.14/asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch
new file mode 100644 (file)
index 0000000..91da064
--- /dev/null
+++ b/queue-4.14/asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch
@@ -0,0 +1,43 @@
+From f33bcc506050f89433a52a3052054d4ebd37b1c1 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Fri, 25 Nov 2022 16:23:47 +0000
+Subject: ASoC: ops: Correct bounds check for second channel on SX controls
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+commit f33bcc506050f89433a52a3052054d4ebd37b1c1 upstream.
+
+Currently the check against the max value for the control is being
+applied after the value has had the minimum applied and been masked. But
+the max value simply indicates the number of volume levels on an SX
+control, and as such should just be applied on the raw value.
+
+Fixes: 97eea946b939 ("ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20221125162348.1288005-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/soc-ops.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -463,14 +463,15 @@ int snd_soc_put_volsw_sx(struct snd_kcon
+               return err;
+ 
+       if (snd_soc_volsw_is_stereo(mc)) {
+-              val_mask = mask << rshift;
+-              val2 = (ucontrol->value.integer.value[1] + min) & mask;
++              val2 = ucontrol->value.integer.value[1];
+ 
+               if (mc->platform_max && val2 > mc->platform_max)
+                       return -EINVAL;
+               if (val2 > max)
+                       return -EINVAL;
+ 
++              val_mask = mask << rshift;
++              val2 = (val2 + min) & mask;
+               val2 = val2 << rshift;
+ 
+               err = snd_soc_component_update_bits(component, reg2, val_mask,

diff --git a/queue-4.14/series b/queue-4.14/series
index 02ce1e29c2014ba85c60cce562b9327496bf8174..4c2cd8f65e929d1f4f9829d22cb304672a3f993e 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -7,3 +7,4 @@ nfp-fix-use-after-free-in-area_cache_get.patch
 asoc-ops-check-bounds-for-second-channel-in-snd_soc_.patch
 can-sja1000-fix-size-of-ocr_mode_mask-define.patch
 can-mcba_usb-fix-termination-command-argument.patch
+asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch