git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 0149302a30bc1010922510e171470f9e07683d36 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Tue, 3 Nov 2020 13:18:07 +0300
   4 Subject: ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
   5
   6 From: Dan Carpenter <dan.carpenter@oracle.com>
   7
   8 [ Upstream commit 158e1886b6262c1d1c96a18c85fac5219b8bf804 ]
   9
  10 This is harmless, but the "addr" comes from the user and it could lead
  11 to a negative shift or to shift wrapping if it's too high.
  12
  13 Fixes: 0b00a5615dc4 ("ALSA: hdac_ext: add hdac extended controller")
  14 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  15 Link: https://lore.kernel.org/r/20201103101807.GC1127762@mwanda
  16 Signed-off-by: Takashi Iwai <tiwai@suse.de>
  17 Signed-off-by: Sasha Levin <sashal@kernel.org>
  18 ---
  19  sound/hda/ext/hdac_ext_controller.c | 2 ++
  20  1 file changed, 2 insertions(+)
  21
  22 diff --git a/sound/hda/ext/hdac_ext_controller.c b/sound/hda/ext/hdac_ext_controller.c
  23 index 4d060d5b1db6d..b0c0ef824d7d9 100644
  24 --- a/sound/hda/ext/hdac_ext_controller.c
  25 +++ b/sound/hda/ext/hdac_ext_controller.c
  26 @@ -148,6 +148,8 @@ struct hdac_ext_link *snd_hdac_ext_bus_get_link(struct hdac_bus *bus,
  27                 return NULL;
  28         if (bus->idx != bus_idx)
  29                 return NULL;
  30 +       if (addr < 0 || addr > 31)
  31 +               return NULL;
  32
  33         list_for_each_entry(hlink, &bus->hlink_list, list) {
  34                 for (i = 0; i < HDA_MAX_CODECS; i++) {
  35 --
  36 2.27.0
  37