From patchwork Fri Nov 25 15:48:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Charles Keepax X-Patchwork-Id: 13056097 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 20F19C43219 for ; Fri, 25 Nov 2022 15:50:05 +0000 (UTC) Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id 47EF41746; Fri, 25 Nov 2022 16:49:13 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz 47EF41746 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1669391403; bh=XSHz6VR717egXDK5UvEyRnfZr/xU2xm8kEcDWoVLpbY=; h=From:To:Subject:Date:In-Reply-To:References:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=ceBAu1az2YwryHBG7fKrEX6tk6FHgHYUpVKXCkhHtEsz2vV1CwRMc+H282c0/AtAY nkcnawfiM7+2r0Dkp2hcZjbwkqRLcmYY81QQcwkCdx2jb/r4EV0Fwladq2St9Fjq4y mm8YRoG4mrkyY45Xk6+S3T6ay7QxPxeIdM9b2hOo= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id B9508F804DA; Fri, 25 Nov 2022 16:48:49 +0100 (CET) Received: by alsa1.perex.cz (Postfix, from userid 50401) id C15B0F8047C; Fri, 25 Nov 2022 16:48:47 +0100 (CET) Received: from mx0b-001ae601.pphosted.com (mx0b-001ae601.pphosted.com [67.231.152.168]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 87177F80171 for ; Fri, 25 Nov 2022 16:48:40 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 87177F80171 Authentication-Results: alsa1.perex.cz; dkim=pass (2048-bit key) header.d=cirrus.com header.i=@cirrus.com header.b="Q9q9CyUG" Received: from pps.filterd (m0077474.ppops.net [127.0.0.1]) by mx0b-001ae601.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 2AP8g16o009072; Fri, 25 Nov 2022 09:48:39 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cirrus.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=PODMain02222019; bh=zf6y8h8ZDqaMeXUKH5IWTKTnF1vtMDxWcziGIWTL3Yg=; b=Q9q9CyUGW/YoJxHI2gF2K01cvlN+Y/3DjiezflKBmqwlrwg/mXAV3xG1Nv+A8nGYpDTT g/ifX1NXcXlvpElkuriSUL7gkdEIwCppCmNITJScjvBOzps1WfZX16mm4bCU8d0grSmg cXYRyKEyAhnQ/QxDUslQZNK2CL1Xk8Po0iKBI0cUX2qI2QTILXfPUbUQrP44hWwoU/OA fhMj7l5S7iOQgONmjhVgY4vslr8xm6BzaKmEjo7vqFYGK6C6PwEoPDHzkEIWXPhEu74R uR0Dtwfgsl97gwt3LHsmVnMc/hVIOel8ACK9B89FtRaaqcxcbVUTrHs9TAIbi+/mzsP7 uw== Received: from ediex01.ad.cirrus.com ([84.19.233.68]) by mx0b-001ae601.pphosted.com (PPS) with ESMTPS id 3kxvet7f2w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 25 Nov 2022 09:48:39 -0600 Received: from ediex01.ad.cirrus.com (198.61.84.80) by ediex01.ad.cirrus.com (198.61.84.80) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.20; Fri, 25 Nov 2022 09:48:37 -0600 Received: from ediswmail.ad.cirrus.com (198.61.86.93) by ediex01.ad.cirrus.com (198.61.84.80) with Microsoft SMTP Server id 15.2.1118.20 via Frontend Transport; Fri, 25 Nov 2022 09:48:37 -0600 Received: from algalon.ad.cirrus.com (algalon.ad.cirrus.com [198.90.251.122]) by ediswmail.ad.cirrus.com (Postfix) with ESMTP id B8109B10; Fri, 25 Nov 2022 15:48:37 +0000 (UTC) From: Charles Keepax To: Subject: [PATCH 1/2] ASoC: ops: Fix bounds check for _sx controls Date: Fri, 25 Nov 2022 15:48:36 +0000 Message-ID: <20221125154837.1270501-2-ckeepax@opensource.cirrus.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20221125154837.1270501-1-ckeepax@opensource.cirrus.com> References: <20221125154837.1270501-1-ckeepax@opensource.cirrus.com> MIME-Version: 1.0 X-Proofpoint-ORIG-GUID: BWQLL--qx7DDKPymZSKwuQ83k7uR-9ig X-Proofpoint-GUID: BWQLL--qx7DDKPymZSKwuQ83k7uR-9ig X-Proofpoint-Spam-Reason: safe Cc: patches@opensource.cirrus.com, alsa-devel@alsa-project.org, guille.rodriguez@gmail.com, lgirdwood@gmail.com X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" From: Mark Brown For _sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in snd_soc_put_volsw_sx() needs to just check against the maximum value. Fixes: 4f1e50d6a9cf ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()") Signed-off-by: Mark Brown Signed-off-by: Charles Keepax --- sound/soc/soc-ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index bd88de0563583..47691119306fb 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -452,7 +452,7 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, val = ucontrol->value.integer.value[0]; if (mc->platform_max && val > mc->platform_max) return -EINVAL; - if (val > max - min) + if (val > max) return -EINVAL; val_mask = mask << shift; val = (val + min) & mask; From patchwork Fri Nov 25 15:48:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Charles Keepax X-Patchwork-Id: 13056096 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5D71BC4332F for ; Fri, 25 Nov 2022 15:49:41 +0000 (UTC) Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id 65A3A1734; Fri, 25 Nov 2022 16:48:49 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz 65A3A1734 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1669391379; bh=jhyI7Tti8iFccb1SBBidKLV74lIRKqerjW3LSv0ReWk=; h=From:To:Subject:Date:In-Reply-To:References:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=T5c8/yPx/Y/h4ygyFgXu0J2gPb1ak68HQsW5diLi4XbLOFPOp0DSpXvpFI+MBKxS5 xQcoM04uas1LiNxSUkgmJ2/qD41O6vm+eswqWIY6XWXhE04DkOD3joJyCIuGl9BN5f miTumdVnkBz5/Ku3BeLs/gt2Myyc9+cDdMjaEIqg= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id 15259F800F4; Fri, 25 Nov 2022 16:48:49 +0100 (CET) Received: by alsa1.perex.cz (Postfix, from userid 50401) id 69FBAF804C2; Fri, 25 Nov 2022 16:48:47 +0100 (CET) Received: from mx0b-001ae601.pphosted.com (mx0b-001ae601.pphosted.com [67.231.152.168]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 7BFF7F8014E for ; Fri, 25 Nov 2022 16:48:41 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 7BFF7F8014E Authentication-Results: alsa1.perex.cz; dkim=pass (2048-bit key) header.d=cirrus.com header.i=@cirrus.com header.b="L4RulWX0" Received: from pps.filterd (m0077474.ppops.net [127.0.0.1]) by mx0b-001ae601.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 2APAeIZH029176; Fri, 25 Nov 2022 09:48:40 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cirrus.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=PODMain02222019; bh=uW/WpNmmC7tC7iQ8OZIjE3xzDFP6uUHt4byQTyCpPoI=; b=L4RulWX03DXmAp7H8eghaaI2AZB3dR3EX7n7j1iKIIgJ+5SzKChDqnlKCG/KWsNdJC06 oXS/0dbjBdipymOkWPrs9OF58BxTo8AUsoZdR8T0FMudqUknYzYVgu91rqZz9QPYE/Yf oc1z1DjaNUxOlJNwo7r4vFB1+0kU/HsXrI3UrwqhDqkHzHLGIiC7cQP3hQVzz1OrNDIp /9/5VauuUbi/vFjDQndBIBqkj5CMIxLX3TxFNk2vKJhKPgv3NR3kQRLP6C+sDF4dJrKr ph/cNrTsZXz18isdhpW0Np4YGToS0vmf8Syl5akaDjNrG3Kr/FG92sGxRY4ZQwytEHxt KQ== Received: from ediex02.ad.cirrus.com ([84.19.233.68]) by mx0b-001ae601.pphosted.com (PPS) with ESMTPS id 3kxvet7f2v-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 25 Nov 2022 09:48:39 -0600 Received: from ediex01.ad.cirrus.com (198.61.84.80) by ediex02.ad.cirrus.com (198.61.84.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.20; Fri, 25 Nov 2022 09:48:37 -0600 Received: from ediswmail.ad.cirrus.com (198.61.86.93) by ediex01.ad.cirrus.com (198.61.84.80) with Microsoft SMTP Server id 15.2.1118.20 via Frontend Transport; Fri, 25 Nov 2022 09:48:37 -0600 Received: from algalon.ad.cirrus.com (algalon.ad.cirrus.com [198.90.251.122]) by ediswmail.ad.cirrus.com (Postfix) with ESMTP id C4C4E2BA; Fri, 25 Nov 2022 15:48:37 +0000 (UTC) From: Charles Keepax To: Subject: [PATCH 2/2] ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() Date: Fri, 25 Nov 2022 15:48:37 +0000 Message-ID: <20221125154837.1270501-3-ckeepax@opensource.cirrus.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20221125154837.1270501-1-ckeepax@opensource.cirrus.com> References: <20221125154837.1270501-1-ckeepax@opensource.cirrus.com> MIME-Version: 1.0 X-Proofpoint-ORIG-GUID: DoyPQfFDUzIbyFo8XgGVz_FFqTZV9Wj5 X-Proofpoint-GUID: DoyPQfFDUzIbyFo8XgGVz_FFqTZV9Wj5 X-Proofpoint-Spam-Reason: safe Cc: patches@opensource.cirrus.com, alsa-devel@alsa-project.org, guille.rodriguez@gmail.com, lgirdwood@gmail.com X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" From: Mark Brown The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks. Signed-off-by: Mark Brown Signed-off-by: Charles Keepax --- Slight fixup was made over your original version to make the check of val2 > max be without the min and mask applied. Thanks, Charles sound/soc/soc-ops.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 47691119306fb..55b009d3c6815 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -464,10 +464,15 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, ret = err; if (snd_soc_volsw_is_stereo(mc)) { - unsigned int val2; + unsigned int val2 = ucontrol->value.integer.value[1]; + + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max) + return -EINVAL; val_mask = mask << rshift; - val2 = (ucontrol->value.integer.value[1] + min) & mask; + val2 = (val2 + min) & mask; val2 = val2 << rshift; err = snd_soc_component_update_bits(component, reg2, val_mask,