From: Greg Kroah-Hartman Date: Sat, 5 Mar 2022 11:26:38 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.9.305~86 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=67356c2483c65bcefd8fa7d6a44c06f22222f6e5;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch --- diff --git a/queue-5.4/alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch b/queue-5.4/alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch new file mode 100644 index 00000000000..e7eeb55b387 --- /dev/null +++ b/queue-5.4/alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch @@ -0,0 +1,35 @@ +From 0aa6b294b312d9710804679abd2c0c8ca52cc2bc Mon Sep 17 00:00:00 2001 +From: Zhen Ni +Date: Wed, 2 Mar 2022 15:42:41 +0800 +Subject: ALSA: intel_hdmi: Fix reference to PCM buffer address + +From: Zhen Ni + +commit 0aa6b294b312d9710804679abd2c0c8ca52cc2bc upstream. + +PCM buffers might be allocated dynamically when the buffer +preallocation failed or a larger buffer is requested, and it's not +guaranteed that substream->dma_buffer points to the actually used +buffer. The driver needs to refer to substream->runtime->dma_addr +instead for the buffer address. + +Signed-off-by: Zhen Ni +Cc: +Link: https://lore.kernel.org/r/20220302074241.30469-1-nizhen@uniontech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/x86/intel_hdmi_audio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/x86/intel_hdmi_audio.c ++++ b/sound/x86/intel_hdmi_audio.c +@@ -1279,7 +1279,7 @@ static int had_pcm_mmap(struct snd_pcm_s + { + vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); + return remap_pfn_range(vma, vma->vm_start, +- substream->dma_buffer.addr >> PAGE_SHIFT, ++ substream->runtime->dma_addr >> PAGE_SHIFT, + vma->vm_end - vma->vm_start, vma->vm_page_prot); + } + diff --git a/queue-5.4/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch b/queue-5.4/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch new file mode 100644 index 00000000000..fe5778bba70 --- /dev/null +++ b/queue-5.4/asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch @@ -0,0 +1,45 @@ +From 9bdd10d57a8807dba0003af0325191f3cec0f11c Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Tue, 15 Feb 2022 14:06:45 +0100 +Subject: ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min + +From: Marek Vasut + +commit 9bdd10d57a8807dba0003af0325191f3cec0f11c upstream. + +While the $val/$val2 values passed in from userspace are always >= 0 +integers, the limits of the control can be signed integers and the $min +can be non-zero and less than zero. To correctly validate $val/$val2 +against platform_max, add the $min offset to val first. + +Fixes: 817f7c9335ec0 ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()") +Signed-off-by: Marek Vasut +Cc: Mark Brown +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220215130645.164025-1-marex@denx.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/soc-ops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -323,7 +323,7 @@ int snd_soc_put_volsw(struct snd_kcontro + mask = BIT(sign_bit + 1) - 1; + + val = ucontrol->value.integer.value[0]; +- if (mc->platform_max && val > mc->platform_max) ++ if (mc->platform_max && ((int)val + min) > mc->platform_max) + return -EINVAL; + if (val > max - min) + return -EINVAL; +@@ -336,7 +336,7 @@ int snd_soc_put_volsw(struct snd_kcontro + val = val << shift; + if (snd_soc_volsw_is_stereo(mc)) { + val2 = ucontrol->value.integer.value[1]; +- if (mc->platform_max && val2 > mc->platform_max) ++ if (mc->platform_max && ((int)val2 + min) > mc->platform_max) + return -EINVAL; + if (val2 > max - min) + return -EINVAL; diff --git a/queue-5.4/series b/queue-5.4/series index ffc559675f6..b56709feb23 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -12,3 +12,5 @@ net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch usb-gadget-don-t-release-an-existing-dev-buf.patch usb-gadget-clear-related-members-when-goto-fail.patch ata-pata_hpt37x-fix-pci-clock-detection.patch +alsa-intel_hdmi-fix-reference-to-pcm-buffer-address.patch +asoc-ops-shift-tested-values-in-snd_soc_put_volsw-by-min.patch