Hi!
commit 4f1e50d6a9cf9c1b8c859d449b5031cacfa8404e upstream.
We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range.
We are getting reports that this commit breaks audio on some phones... and indeed it looks like "+ min" is missing in first condition:
https://github.com/baunilla/android_kernel_xiaomi_rosy/commit/969b9d366c1e95...
val = ucontrol->value.integer.value[0]; - if (mc->platform_max && val > mc->platform_max) + if (mc->platform_max && ((int)val + min) > mc->platform_max)  return -EINVAL;
What needs to be done to get this fixed?
Best regards, Pavel
Reported-by: theflamefire89@gmail.com
Signed-off-by: Mark Brown broonie@kernel.org Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220124153253.3548853-3-broonie@kernel.org Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
sound/soc/soc-ops.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
--- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -441,8 +441,15 @@ int snd_soc_put_volsw_sx(struct snd_kcon int err = 0; unsigned int val, val_mask, val2 = 0;
- val = ucontrol->value.integer.value[0];
- if (mc->platform_max && val > mc->platform_max)
return -EINVAL;- if (val > max - min)
return -EINVAL;- if (val < 0)
return -EINVAL;
- val = (ucontrol->value.integer.value[0] + min) & mask;
- val = (val + min) & mask; val = val << shift;
err = snd_soc_component_update_bits(component, reg, val_mask, val);