Blame patches.suse/ALSA-hda-prevent-undefined-shift-in-snd_hdac_ext_bus.patch
|
Takashi Iwai |
a7f45e |
From 158e1886b6262c1d1c96a18c85fac5219b8bf804 Mon Sep 17 00:00:00 2001
|
|
Takashi Iwai |
a7f45e |
From: Dan Carpenter <dan.carpenter@oracle.com>
|
|
Takashi Iwai |
a7f45e |
Date: Tue, 3 Nov 2020 13:18:07 +0300
|
|
Takashi Iwai |
a7f45e |
Subject: [PATCH] ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
|
|
Takashi Iwai |
a7f45e |
Git-commit: 158e1886b6262c1d1c96a18c85fac5219b8bf804
|
|
Takashi Iwai |
a7f45e |
Patch-mainline: v5.10-rc3
|
|
Takashi Iwai |
a7f45e |
References: git-fixes
|
|
Takashi Iwai |
a7f45e |
|
|
Takashi Iwai |
a7f45e |
This is harmless, but the "addr" comes from the user and it could lead
|
|
Takashi Iwai |
a7f45e |
to a negative shift or to shift wrapping if it's too high.
|
|
Takashi Iwai |
a7f45e |
|
|
Takashi Iwai |
a7f45e |
Fixes: 0b00a5615dc4 ("ALSA: hdac_ext: add hdac extended controller")
|
|
Takashi Iwai |
a7f45e |
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
|
|
Takashi Iwai |
a7f45e |
Link: https://lore.kernel.org/r/20201103101807.GC1127762@mwanda
|
|
Takashi Iwai |
a7f45e |
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
Takashi Iwai |
a7f45e |
|
|
Takashi Iwai |
a7f45e |
---
|
|
Takashi Iwai |
a7f45e |
sound/hda/ext/hdac_ext_controller.c | 2 ++
|
|
Takashi Iwai |
a7f45e |
1 file changed, 2 insertions(+)
|
|
Takashi Iwai |
a7f45e |
|
|
Takashi Iwai |
a7f45e |
--- a/sound/hda/ext/hdac_ext_controller.c
|
|
Takashi Iwai |
a7f45e |
+++ b/sound/hda/ext/hdac_ext_controller.c
|
|
Takashi Iwai |
a7f45e |
@@ -155,6 +155,8 @@ struct hdac_ext_link *snd_hdac_ext_bus_g
|
|
Takashi Iwai |
a7f45e |
return NULL;
|
|
Takashi Iwai |
a7f45e |
if (ebus->idx != bus_idx)
|
|
Takashi Iwai |
a7f45e |
return NULL;
|
|
Takashi Iwai |
a7f45e |
+ if (addr < 0 || addr > 31)
|
|
Takashi Iwai |
a7f45e |
+ return NULL;
|
|
Takashi Iwai |
a7f45e |
|
|
Takashi Iwai |
a7f45e |
list_for_each_entry(hlink, &ebus->hlink_list, list) {
|
|
Takashi Iwai |
a7f45e |
for (i = 0; i < HDA_MAX_CODECS; i++) {
|