diff options
| author | Mark Brown <broonie@kernel.org> | 2025-04-15 16:31:51 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-04-15 17:31:30 +0300 |
| commit | c96e16dfbfc54e9752b1fc780400348e0926d215 (patch) | |
| tree | 9b6772516a6717ad89fcda0be5aac9e87c099b2a | |
| parent | c215f0b5b858f59ddf0e5dde012099739f10d05d (diff) | |
| download | linux-c96e16dfbfc54e9752b1fc780400348e0926d215.tar.xz | |
staging: bcm2835-audio: Validate values written to controls
The bcm2835-audio driver makes no effort to validate the values it accepts
from userspace, causing it to accept invalid values:
# # PCM Playback Switch.0 Invalid boolean value 2
# not ok 5 write_invalid.Headphones.1
# # PCM Playback Volume.0 value -10240 less than minimum -10239
# # PCM Playback Volume.0 value 401 more than maximum 400
# not ok 12 write_invalid.Headphones.0
Add validation.
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20250415-staging-bcm2835-alsa-limit-v1-1-4ed816e9c0fc@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c index 1c1f040122d7..7d0ddd5c8cce 100644 --- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c +++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c @@ -71,6 +71,7 @@ static int snd_bcm2835_ctl_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) { struct bcm2835_chip *chip = snd_kcontrol_chip(kcontrol); + struct snd_ctl_elem_info info; int val, *valp; int changed = 0; @@ -84,6 +85,11 @@ static int snd_bcm2835_ctl_put(struct snd_kcontrol *kcontrol, return -EINVAL; val = ucontrol->value.integer.value[0]; + + snd_bcm2835_ctl_info(kcontrol, &info); + if (val < info.value.integer.min || val > info.value.integer.max) + return -EINVAL; + mutex_lock(&chip->audio_mutex); if (val != *valp) { *valp = val; |