4.9-stable patches

added patches:
	asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch

diff --git a/queue-4.9/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch b/queue-4.9/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch
new file mode 100644 (file)
index 0000000..9232ecc
--- /dev/null
+++ b/queue-4.9/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch
@@ -0,0 +1,45 @@
+From 9bdd10d57a8807dba0003af0325191f3cec0f11c Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 15 Feb 2022 14:06:45 +0100
+Subject: ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
+
+From: Marek Vasut <marex@denx.de>
+
+commit 9bdd10d57a8807dba0003af0325191f3cec0f11c upstream.
+
+While the $val/$val2 values passed in from userspace are always >= 0
+integers, the limits of the control can be signed integers and the $min
+can be non-zero and less than zero. To correctly validate $val/$val2
+against platform_max, add the $min offset to val first.
+
+Fixes: 817f7c9335ec0 ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220215130645.164025-1-marex@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/soc-ops.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -328,7 +328,7 @@ int snd_soc_put_volsw(struct snd_kcontro
+               mask = BIT(sign_bit + 1) - 1;
+ 
+       val = ucontrol->value.integer.value[0];
+-      if (mc->platform_max && val > mc->platform_max)
++      if (mc->platform_max && ((int)val + min) > mc->platform_max)
+               return -EINVAL;
+       if (val > max - min)
+               return -EINVAL;
+@@ -341,7 +341,7 @@ int snd_soc_put_volsw(struct snd_kcontro
+       val = val << shift;
+       if (snd_soc_volsw_is_stereo(mc)) {
+               val2 = ucontrol->value.integer.value[1];
+-              if (mc->platform_max && val2 > mc->platform_max)
++              if (mc->platform_max && ((int)val2 + min) > mc->platform_max)
+                       return -EINVAL;
+               if (val2 > max - min)
+                       return -EINVAL;

diff --git a/queue-4.9/ata-pata_hpt37x-fix-pci-clock-detection.patch b/queue-4.9/ata-pata_hpt37x-fix-pci-clock-detection.patch
index d446fc442fb688576b636e11a1d5d40c2be917e7..3eaac03a988583649a8c82e7723c2208cba0524a 100644 (file)
--- a/queue-4.9/ata-pata_hpt37x-fix-pci-clock-detection.patch
+++ b/queue-4.9/ata-pata_hpt37x-fix-pci-clock-detection.patch
@@ -16,14 +16,12 @@ Cc: stable@vger.kernel.org
 Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- drivers/ata/pata_hpt37x.c | 4 ++--
+ drivers/ata/pata_hpt37x.c |    4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
-diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
-index 821fc1f2324c8..44cc02afaa8bd 100644
 --- a/drivers/ata/pata_hpt37x.c
 +++ b/drivers/ata/pata_hpt37x.c
-@@ -964,14 +964,14 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+@@ -964,14 +964,14 @@ static int hpt37x_init_one(struct pci_de
  
        if ((freq >> 12) != 0xABCDE) {
                int i;
@@ -40,6 +38,3 @@ index 821fc1f2324c8..44cc02afaa8bd 100644
                        total += sr & 0x1FF;
                        udelay(15);
                }
--- 
-2.34.1
-

diff --git a/queue-4.9/series b/queue-4.9/series
index d5f7b1434a0d5ba9aa517ae48b05ff8a939bc6e2..f59b87b41726580ec8a5fb65244621c4c486fb5a 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -9,3 +9,4 @@ net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch
 usb-gadget-don-t-release-an-existing-dev-buf.patch
 usb-gadget-clear-related-members-when-goto-fail.patch
 ata-pata_hpt37x-fix-pci-clock-detection.patch
+asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch