From fbb5b56ca1b5a9c9751fe219cf0c6f1c52213c4f Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Fri, 1 Nov 2024 14:40:22 +0800 Subject: [PATCH] ASoC: ops: Fix bounds check for _sx controls stable inclusion from stable-v5.10.158 commit b50c9641897274c3faef5f95ac852f54b94be2e8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF8 CVE: CVE-2022-49005 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b50c9641897274c3faef5f95ac852f54b94be2e8 -------------------------------- [ Upstream commit 698813ba8c580efb356ace8dbf55f61dac6063a8 ] For _sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in snd_soc_put_volsw_sx() needs to just check against the maximum value. Fixes: 4f1e50d6a9cf9c1b ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220511134137.169575-1-broonie@kernel.org Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Signed-off-by: Heyuan Wang --- sound/soc/soc-ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 0f26d6c31ce5..5fdd96e77ef3 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -432,7 +432,7 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, val = ucontrol->value.integer.value[0]; if (mc->platform_max && val > mc->platform_max) return -EINVAL; - if (val > max - min) + if (val > max) return -EINVAL; if (val < 0) return -EINVAL; -- Gitee