From: Greg Kroah-Hartman Date: Sat, 5 Mar 2022 11:25:51 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.9.305~89 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5cd4e2ca998fb87390f694b24fd6171ebf14fcc4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch --- diff --git a/queue-4.9/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch b/queue-4.9/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch new file mode 100644 index 00000000000..9232ecc33df --- /dev/null +++ b/queue-4.9/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch @@ -0,0 +1,45 @@ +From 9bdd10d57a8807dba0003af0325191f3cec0f11c Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Tue, 15 Feb 2022 14:06:45 +0100 +Subject: ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min + +From: Marek Vasut + +commit 9bdd10d57a8807dba0003af0325191f3cec0f11c upstream. + +While the $val/$val2 values passed in from userspace are always >= 0 +integers, the limits of the control can be signed integers and the $min +can be non-zero and less than zero. To correctly validate $val/$val2 +against platform_max, add the $min offset to val first. + +Fixes: 817f7c9335ec0 ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()") +Signed-off-by: Marek Vasut +Cc: Mark Brown +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220215130645.164025-1-marex@denx.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/soc-ops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -328,7 +328,7 @@ int snd_soc_put_volsw(struct snd_kcontro + mask = BIT(sign_bit + 1) - 1; + + val = ucontrol->value.integer.value[0]; +- if (mc->platform_max && val > mc->platform_max) ++ if (mc->platform_max && ((int)val + min) > mc->platform_max) + return -EINVAL; + if (val > max - min) + return -EINVAL; +@@ -341,7 +341,7 @@ int snd_soc_put_volsw(struct snd_kcontro + val = val << shift; + if (snd_soc_volsw_is_stereo(mc)) { + val2 = ucontrol->value.integer.value[1]; +- if (mc->platform_max && val2 > mc->platform_max) ++ if (mc->platform_max && ((int)val2 + min) > mc->platform_max) + return -EINVAL; + if (val2 > max - min) + return -EINVAL; diff --git a/queue-4.9/ata-pata_hpt37x-fix-pci-clock-detection.patch b/queue-4.9/ata-pata_hpt37x-fix-pci-clock-detection.patch index d446fc442fb..3eaac03a988 100644 --- a/queue-4.9/ata-pata_hpt37x-fix-pci-clock-detection.patch +++ b/queue-4.9/ata-pata_hpt37x-fix-pci-clock-detection.patch @@ -16,14 +16,12 @@ Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Sasha Levin --- - drivers/ata/pata_hpt37x.c | 4 ++-- + drivers/ata/pata_hpt37x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c -index 821fc1f2324c8..44cc02afaa8bd 100644 --- a/drivers/ata/pata_hpt37x.c +++ b/drivers/ata/pata_hpt37x.c -@@ -964,14 +964,14 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id) +@@ -964,14 +964,14 @@ static int hpt37x_init_one(struct pci_de if ((freq >> 12) != 0xABCDE) { int i; @@ -40,6 +38,3 @@ index 821fc1f2324c8..44cc02afaa8bd 100644 total += sr & 0x1FF; udelay(15); } --- -2.34.1 - diff --git a/queue-4.9/series b/queue-4.9/series index d5f7b1434a0..f59b87b4172 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -9,3 +9,4 @@ net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch usb-gadget-don-t-release-an-existing-dev-buf.patch usb-gadget-clear-related-members-when-goto-fail.patch ata-pata_hpt37x-fix-pci-clock-detection.patch +asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch