From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CC24C38A2F for ; Sat, 18 Apr 2020 14:43:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4DE2B2224E for ; Sat, 18 Apr 2020 14:43:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1587221002; bh=bdRG4QJSIh1FzpVsaOuoYBVt/Quoq5dTXWozMxcztH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=su2gWPy1m6CEDBOlShxWE3CC0NL8tjCIHRNVi1l+VDBuZR0TI9Xw0honwahv+krkA gpFqj7rm/UptHk+eOmFhUbCjUrTWz/B0za9+tucQfCesfJ0bTB1n8yKlH29U4qGrzN LVzaESLkbWQaKUQSOMt8ZGLf8H/C6Dy8A66oe4l0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728559AbgDROnV (ORCPT ); Sat, 18 Apr 2020 10:43:21 -0400 Received: from mail.kernel.org ([198.145.29.99]:54018 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726469AbgDROnL (ORCPT ); Sat, 18 Apr 2020 10:43:11 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0B9E721D79; Sat, 18 Apr 2020 14:43:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1587220990; bh=bdRG4QJSIh1FzpVsaOuoYBVt/Quoq5dTXWozMxcztH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z9+/uCVUsIS1wA8A9iUrSz1hRaBoh789zdR0mIB+nIkmijPROSwwF9UHQ2fwH0mak TvqP1vXkJ7KLKQUJLY1Ou4BSZBrlKxhTVt3hst+kEOIv/9L5ZiU0FgFHH9aDvi6hbK H2h2p90J2iHh6oyAmL/0YUuuhckjsAd49iX6UGQ0= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Takashi Iwai , Jaroslav Kysela , Sasha Levin , alsa-devel@alsa-project.org Subject: [PATCH AUTOSEL 4.19 34/47] ALSA: hda: Fix potential access overflow in beep helper Date: Sat, 18 Apr 2020 10:42:14 -0400 Message-Id: <20200418144227.9802-34-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200418144227.9802-1-sashal@kernel.org> References: <20200418144227.9802-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Takashi Iwai [ Upstream commit 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a ] The beep control helper function blindly stores the values in two stereo channels no matter whether the actual control is mono or stereo. This is practically harmless, but it annoys the recently introduced sanity check, resulting in an error when the checker is enabled. This patch corrects the behavior to store only on the defined array member. Fixes: 0401e8548eac ("ALSA: hda - Move beep helper functions to hda_beep.c") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207139 Reviewed-by: Jaroslav Kysela Cc: Link: https://lore.kernel.org/r/20200407084402.25589-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/pci/hda/hda_beep.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/pci/hda/hda_beep.c b/sound/pci/hda/hda_beep.c index 066b5b59c4d7c..0224011a240fb 100644 --- a/sound/pci/hda/hda_beep.c +++ b/sound/pci/hda/hda_beep.c @@ -297,8 +297,12 @@ int snd_hda_mixer_amp_switch_get_beep(struct snd_kcontrol *kcontrol, { struct hda_codec *codec = snd_kcontrol_chip(kcontrol); struct hda_beep *beep = codec->beep; + int chs = get_amp_channels(kcontrol); + if (beep && (!beep->enabled || !ctl_has_mute(kcontrol))) { - ucontrol->value.integer.value[0] = + if (chs & 1) + ucontrol->value.integer.value[0] = beep->enabled; + if (chs & 2) ucontrol->value.integer.value[1] = beep->enabled; return 0; } -- 2.20.1