From 13d0ab4b5a13cf0c735d6ed39a00ae01f3a387a0 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 19 Dec 2022 11:18:32 +0100 Subject: [PATCH] 4.14-stable patches added patches: asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch --- ...ck-for-second-channel-on-sx-controls.patch | 43 +++++++++++++++++++ queue-4.14/series | 1 + 2 files changed, 44 insertions(+) create mode 100644 queue-4.14/asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch diff --git a/queue-4.14/asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch b/queue-4.14/asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch new file mode 100644 index 00000000000..91da0645e15 --- /dev/null +++ b/queue-4.14/asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch @@ -0,0 +1,43 @@ +From f33bcc506050f89433a52a3052054d4ebd37b1c1 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Fri, 25 Nov 2022 16:23:47 +0000 +Subject: ASoC: ops: Correct bounds check for second channel on SX controls + +From: Charles Keepax + +commit f33bcc506050f89433a52a3052054d4ebd37b1c1 upstream. + +Currently the check against the max value for the control is being +applied after the value has had the minimum applied and been masked. But +the max value simply indicates the number of volume levels on an SX +control, and as such should just be applied on the raw value. + +Fixes: 97eea946b939 ("ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20221125162348.1288005-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/soc-ops.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -463,14 +463,15 @@ int snd_soc_put_volsw_sx(struct snd_kcon + return err; + + if (snd_soc_volsw_is_stereo(mc)) { +- val_mask = mask << rshift; +- val2 = (ucontrol->value.integer.value[1] + min) & mask; ++ val2 = ucontrol->value.integer.value[1]; + + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max) + return -EINVAL; + ++ val_mask = mask << rshift; ++ val2 = (val2 + min) & mask; + val2 = val2 << rshift; + + err = snd_soc_component_update_bits(component, reg2, val_mask, diff --git a/queue-4.14/series b/queue-4.14/series index 02ce1e29c20..4c2cd8f65e9 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -7,3 +7,4 @@ nfp-fix-use-after-free-in-area_cache_get.patch asoc-ops-check-bounds-for-second-channel-in-snd_soc_.patch can-sja1000-fix-size-of-ocr_mode_mask-define.patch can-mcba_usb-fix-termination-command-argument.patch +asoc-ops-correct-bounds-check-for-second-channel-on-sx-controls.patch -- 2.47.3