From: Kamal Mostafa <kamal@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
kernel-team@lists.ubuntu.com
Cc: Takashi Iwai <tiwai@suse.de>, Mark Brown <broonie@linaro.org>,
Kamal Mostafa <kamal@canonical.com>
Subject: [PATCH 3.8 52/81] ASoC: sta32x: Fix array access overflow
Date: Tue, 25 Mar 2014 10:16:05 -0700 [thread overview]
Message-ID: <1395767794-5012-53-git-send-email-kamal@canonical.com> (raw)
In-Reply-To: <1395767794-5012-1-git-send-email-kamal@canonical.com>
3.8.13.20 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 025c3fa9256d4c54506b7a29dc3befac54f5c68d upstream.
Preset EQ enum of sta32x codec driver declares too many number of
items and it may lead to the access over the actual array size.
Use SOC_ENUM_SINGLE_DECL() helper and it's automatically fixed.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
sound/soc/codecs/sta32x.c | 72 +++++++++++++++++++++++------------------------
1 file changed, 36 insertions(+), 36 deletions(-)
diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
index cfb55fe..dc5e7f5 100644
--- a/sound/soc/codecs/sta32x.c
+++ b/sound/soc/codecs/sta32x.c
@@ -187,42 +187,42 @@ static const unsigned int sta32x_limiter_drc_release_tlv[] = {
13, 16, TLV_DB_SCALE_ITEM(-1500, 300, 0),
};
-static const struct soc_enum sta32x_drc_ac_enum =
- SOC_ENUM_SINGLE(STA32X_CONFD, STA32X_CONFD_DRC_SHIFT,
- 2, sta32x_drc_ac);
-static const struct soc_enum sta32x_auto_eq_enum =
- SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT,
- 3, sta32x_auto_eq_mode);
-static const struct soc_enum sta32x_auto_gc_enum =
- SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT,
- 4, sta32x_auto_gc_mode);
-static const struct soc_enum sta32x_auto_xo_enum =
- SOC_ENUM_SINGLE(STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT,
- 16, sta32x_auto_xo_mode);
-static const struct soc_enum sta32x_preset_eq_enum =
- SOC_ENUM_SINGLE(STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT,
- 32, sta32x_preset_eq_mode);
-static const struct soc_enum sta32x_limiter_ch1_enum =
- SOC_ENUM_SINGLE(STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT,
- 3, sta32x_limiter_select);
-static const struct soc_enum sta32x_limiter_ch2_enum =
- SOC_ENUM_SINGLE(STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT,
- 3, sta32x_limiter_select);
-static const struct soc_enum sta32x_limiter_ch3_enum =
- SOC_ENUM_SINGLE(STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT,
- 3, sta32x_limiter_select);
-static const struct soc_enum sta32x_limiter1_attack_rate_enum =
- SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxA_SHIFT,
- 16, sta32x_limiter_attack_rate);
-static const struct soc_enum sta32x_limiter2_attack_rate_enum =
- SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxA_SHIFT,
- 16, sta32x_limiter_attack_rate);
-static const struct soc_enum sta32x_limiter1_release_rate_enum =
- SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxR_SHIFT,
- 16, sta32x_limiter_release_rate);
-static const struct soc_enum sta32x_limiter2_release_rate_enum =
- SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxR_SHIFT,
- 16, sta32x_limiter_release_rate);
+static SOC_ENUM_SINGLE_DECL(sta32x_drc_ac_enum,
+ STA32X_CONFD, STA32X_CONFD_DRC_SHIFT,
+ sta32x_drc_ac);
+static SOC_ENUM_SINGLE_DECL(sta32x_auto_eq_enum,
+ STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT,
+ sta32x_auto_eq_mode);
+static SOC_ENUM_SINGLE_DECL(sta32x_auto_gc_enum,
+ STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT,
+ sta32x_auto_gc_mode);
+static SOC_ENUM_SINGLE_DECL(sta32x_auto_xo_enum,
+ STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT,
+ sta32x_auto_xo_mode);
+static SOC_ENUM_SINGLE_DECL(sta32x_preset_eq_enum,
+ STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT,
+ sta32x_preset_eq_mode);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch1_enum,
+ STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT,
+ sta32x_limiter_select);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch2_enum,
+ STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT,
+ sta32x_limiter_select);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch3_enum,
+ STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT,
+ sta32x_limiter_select);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_attack_rate_enum,
+ STA32X_L1AR, STA32X_LxA_SHIFT,
+ sta32x_limiter_attack_rate);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_attack_rate_enum,
+ STA32X_L2AR, STA32X_LxA_SHIFT,
+ sta32x_limiter_attack_rate);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_release_rate_enum,
+ STA32X_L1AR, STA32X_LxR_SHIFT,
+ sta32x_limiter_release_rate);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
+ STA32X_L2AR, STA32X_LxR_SHIFT,
+ sta32x_limiter_release_rate);
/* byte array controls for setting biquad, mixer, scaling coefficients;
* for biquads all five coefficients need to be set in one go,
--
1.8.3.2
next prev parent reply other threads:[~2014-03-25 17:21 UTC|newest]
Thread overview: 84+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-25 17:15 [3.8.y.z extended stable] Linux 3.8.13.20 stable review Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 01/81] kernel.h: define u8, s8, u32, etc. limits Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 02/81] kernel.h: undef clashing U64_MAX, U32_MAX size limits Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 03/81] ata: enable quirk from jmicron JMB350 for JMB394 Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 04/81] sata_sil: apply MOD15WRITE quirk to TOSHIBA MK2561GSYN Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 05/81] cgroup: fix locking in cgroup_cfts_commit() Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 06/81] xfs: ensure correct timestamp updates from truncate Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 07/81] ARM: 7953/1: mm: ensure TLB invalidation is complete before enabling MMU Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 08/81] ARM: 7955/1: spinlock: ensure we have a compiler barrier before sev Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 09/81] ASoC: da9055: Fix device registration of PMIC and CODEC devices Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 10/81] ARM: dma-mapping: fix GFP_ATOMIC macro usage Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 11/81] x86: " Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 12/81] SUNRPC: Fix races in xs_nospace() Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 13/81] drm/i915: Add intel_ring_cachline_align() Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 14/81] drm/i915: Prevent MI_DISPLAY_FLIP straddling two cachelines on IVB Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 15/81] can: kvaser_usb: check number of channels returned by HW Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 16/81] ext4: don't try to modify s_flags if the the file system is read-only Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 17/81] drm/vmwgfx: Fix possible integer overflow Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 18/81] drm/i915/dp: increase native aux defer retry timeout Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 19/81] drm/i915/dp: add native aux defer retry limit Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 20/81] rtlwifi: rtl8192ce: Fix too long disable of IRQs Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 21/81] rtlwifi: Fix incorrect return from rtl_ps_enable_nic() Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 22/81] rtl8187: fix regression on MIPS without coherent DMA Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 23/81] PCI: Enable INTx if BIOS left them disabled Kamal Mostafa
2014-03-25 18:34 ` Bjorn Helgaas
2014-03-25 18:52 ` Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 24/81] cifs: ensure that uncached writes handle unmapped areas correctly Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 25/81] CIFS: Fix too big maxBuf size for SMB3 mounts Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 26/81] ext4: fix online resize with very large inode tables Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 27/81] ext4: fix online resize with a non-standard blocks per group setting Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 28/81] ext4: don't leave i_crtime.tv_sec uninitialized Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 29/81] ALSA: usb-audio: Add a quirk for Plantronics Gamecom 780 Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 30/81] ALSA: usb-audio: work around KEF X300A firmware bug Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 31/81] avr32: fix missing module.h causing build failure in mimc200/fram.c Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 32/81] avr32: Makefile: add '-D__linux__' flag for gcc-4.4.7 use Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 33/81] ARM: 7957/1: add DSB after icache flush in __flush_icache_all() Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 34/81] ACPI / PCI: Fix memory leak in acpi_pci_irq_enable() Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 35/81] ahci: disable NCQ on Samsung pci-e SSDs on macbooks Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 36/81] usb: gadget: bcm63xx_udc: fix build failure on DMA channel code Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 37/81] USB: EHCI: add delay during suspend to prevent erroneous wakeups Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 38/81] USB: serial: option: blacklist interface 4 for Cinterion PHS8 and PXS8 Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 39/81] workqueue: ensure @task is valid across kthread_stop() Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 40/81] cgroup: update cgroup_enable_task_cg_lists() to grab siglock Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 41/81] hwmon: (max1668) Fix writing the minimum temperature Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 42/81] cpufreq: powernow-k8: Initialize per-cpu data-structures properly Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 43/81] ACPI / video: Filter the _BCL table for duplicate brightness values Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 44/81] ARM: 7668/1: fix memset-related crashes caused by recent GCC (4.7.2) optimizations Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 45/81] ARM: 7670/1: fix the memset fix Kamal Mostafa
2014-03-25 17:15 ` [PATCH 3.8 46/81] xtensa: move spill_registers to traps.h Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 47/81] xtensa: clean up stpill_registers Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 48/81] xtensa: introduce spill_registers_kernel macro Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 49/81] dma: ste_dma40: don't dereference free:d descriptor Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 50/81] ARM64: unwind: Fix PC calculation Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 51/81] dm thin: avoid metadata commit if a pool's thin devices haven't changed Kamal Mostafa
2014-03-25 17:16 ` Kamal Mostafa [this message]
2014-03-25 17:16 ` [PATCH 3.8 53/81] ASoC: wm8770: Fix wrong number of enum items Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 54/81] Input - arizona-haptics: Fix double lock of dapm_mutex Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 55/81] ASoC: dapm: Add locking to snd_soc_dapm_xxxx_pin functions Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 56/81] SELinux: bigendian problems with filename trans rules Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 57/81] quota: Fix race between dqput() and dquot_scan_active() Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 58/81] ASoC: sta32x: Fix cache sync Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 59/81] dm thin: fix the error path for the thin device constructor Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 60/81] qla2xxx: Fix kernel panic on selective retransmission request Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 61/81] ASoC: wm8958-dsp: Fix firmware block loading Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 62/81] i7core_edac: Fix PCI device reference count Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 63/81] i7300_edac: Fix " Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 64/81] ipc,mqueue: remove limits for the amount of system-wide queues Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 65/81] PM / hibernate: Fix restore hang in freeze_processes() Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 66/81] ASoC: da732x: Mark DC offset control registers volatile Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 67/81] dm mpath: fix stalls when handling invalid ioctls Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 68/81] ACPI / processor: Rework processor throttling with work_on_cpu() Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 69/81] USB: serial: ftdi_sio: add id for Z3X Box device Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 70/81] USB: ftdi_sio: add Cressi Leonardo PID Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 71/81] usb: ehci: fix deadlock when threadirqs option is used Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 72/81] ASoC: sta32x: Fix wrong enum for limiter2 release rate Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 73/81] perf/x86: Fix event scheduling Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 74/81] perf: Fix hotplug splat Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 75/81] kvm: x86: fix emulator buffer overflow (CVE-2014-0049) Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 76/81] drm/radeon: print the supported atpx function mask Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 77/81] drm/radeon: fix missing bo reservation Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 78/81] drm/radeon: disable pll sharing for DP on DCE4.1 Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 79/81] powerpc/le: Ensure that the 'stop-self' RTAS token is handled correctly Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 80/81] powerpc/crashdump : Fix page frame number check in copy_oldmem_page Kamal Mostafa
2014-03-25 17:16 ` [PATCH 3.8 81/81] arm64: mm: Add double logical invert to pte accessors Kamal Mostafa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1395767794-5012-53-git-send-email-kamal@canonical.com \
--to=kamal@canonical.com \
--cc=broonie@linaro.org \
--cc=kernel-team@lists.ubuntu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®