4.19-stable patches

added patches:
	alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch
	asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch

diff --git a/queue-4.19/alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch b/queue-4.19/alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch
new file mode 100644 (file)
index 0000000..80f107c
--- /dev/null
+++ b/queue-4.19/alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch
@@ -0,0 +1,35 @@
+From 0aa6b294b312d9710804679abd2c0c8ca52cc2bc Mon Sep 17 00:00:00 2001
+From: Zhen Ni <nizhen@uniontech.com>
+Date: Wed, 2 Mar 2022 15:42:41 +0800
+Subject: ALSA: intel_hdmi: Fix reference to PCM buffer address
+
+From: Zhen Ni <nizhen@uniontech.com>
+
+commit 0aa6b294b312d9710804679abd2c0c8ca52cc2bc upstream.
+
+PCM buffers might be allocated dynamically when the buffer
+preallocation failed or a larger buffer is requested, and it's not
+guaranteed that substream->dma_buffer points to the actually used
+buffer.  The driver needs to refer to substream->runtime->dma_addr
+instead for the buffer address.
+
+Signed-off-by: Zhen Ni <nizhen@uniontech.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220302074241.30469-1-nizhen@uniontech.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/x86/intel_hdmi_audio.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/x86/intel_hdmi_audio.c
++++ b/sound/x86/intel_hdmi_audio.c
+@@ -1310,7 +1310,7 @@ static int had_pcm_mmap(struct snd_pcm_s
+ {
+       vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+       return remap_pfn_range(vma, vma->vm_start,
+-                      substream->dma_buffer.addr >> PAGE_SHIFT,
++                      substream->runtime->dma_addr >> PAGE_SHIFT,
+                       vma->vm_end - vma->vm_start, vma->vm_page_prot);
+ }
+ 

diff --git a/queue-4.19/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch b/queue-4.19/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch
new file mode 100644 (file)
index 0000000..fe5778b
--- /dev/null
+++ b/queue-4.19/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch
@@ -0,0 +1,45 @@
+From 9bdd10d57a8807dba0003af0325191f3cec0f11c Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 15 Feb 2022 14:06:45 +0100
+Subject: ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
+
+From: Marek Vasut <marex@denx.de>
+
+commit 9bdd10d57a8807dba0003af0325191f3cec0f11c upstream.
+
+While the $val/$val2 values passed in from userspace are always >= 0
+integers, the limits of the control can be signed integers and the $min
+can be non-zero and less than zero. To correctly validate $val/$val2
+against platform_max, add the $min offset to val first.
+
+Fixes: 817f7c9335ec0 ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220215130645.164025-1-marex@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/soc-ops.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -323,7 +323,7 @@ int snd_soc_put_volsw(struct snd_kcontro
+               mask = BIT(sign_bit + 1) - 1;
+ 
+       val = ucontrol->value.integer.value[0];
+-      if (mc->platform_max && val > mc->platform_max)
++      if (mc->platform_max && ((int)val + min) > mc->platform_max)
+               return -EINVAL;
+       if (val > max - min)
+               return -EINVAL;
+@@ -336,7 +336,7 @@ int snd_soc_put_volsw(struct snd_kcontro
+       val = val << shift;
+       if (snd_soc_volsw_is_stereo(mc)) {
+               val2 = ucontrol->value.integer.value[1];
+-              if (mc->platform_max && val2 > mc->platform_max)
++              if (mc->platform_max && ((int)val2 + min) > mc->platform_max)
+                       return -EINVAL;
+               if (val2 > max - min)
+                       return -EINVAL;

diff --git a/queue-4.19/series b/queue-4.19/series
index ffc559675f62c9be45cfcc4796d3575f9d6b33eb..b56709feb230b5baf6f3cd7dfae6a79b4286450e 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -12,3 +12,5 @@ net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch
 usb-gadget-don-t-release-an-existing-dev-buf.patch
 usb-gadget-clear-related-members-when-goto-fail.patch
 ata-pata_hpt37x-fix-pci-clock-detection.patch
+alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch
+asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch