tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

ALSA: hda - Sanity check of access to SPDIF controls array

Put WARN_ON() and bail out if the given index is over the allocated
array of the given SPDIF controls. It's merely a sanity check to
catch any potential issues (if any).

Signed-off-by: Takashi Iwai <tiwai@suse.de>

Takashi Iwai 08605068 c1a36101

+12
+12
sound/pci/hda/hda_codec.c
··· 2175 2175 int idx = kcontrol->private_value; 2176 2176 struct hda_spdif_out *spdif; 2177 2177 2178 + if (WARN_ON(codec->spdif_out.used <= idx)) 2179 + return -EINVAL; 2178 2180 mutex_lock(&codec->spdif_mutex); 2179 2181 spdif = snd_array_elem(&codec->spdif_out, idx); 2180 2182 ucontrol->value.iec958.status[0] = spdif->status & 0xff; ··· 2284 2282 unsigned short val; 2285 2283 int change; 2286 2284 2285 + if (WARN_ON(codec->spdif_out.used <= idx)) 2286 + return -EINVAL; 2287 2287 mutex_lock(&codec->spdif_mutex); 2288 2288 spdif = snd_array_elem(&codec->spdif_out, idx); 2289 2289 nid = spdif->nid; ··· 2312 2308 int idx = kcontrol->private_value; 2313 2309 struct hda_spdif_out *spdif; 2314 2310 2311 + if (WARN_ON(codec->spdif_out.used <= idx)) 2312 + return -EINVAL; 2315 2313 mutex_lock(&codec->spdif_mutex); 2316 2314 spdif = snd_array_elem(&codec->spdif_out, idx); 2317 2315 ucontrol->value.integer.value[0] = spdif->ctls & AC_DIG1_ENABLE; ··· 2342 2336 unsigned short val; 2343 2337 int change; 2344 2338 2339 + if (WARN_ON(codec->spdif_out.used <= idx)) 2340 + return -EINVAL; 2345 2341 mutex_lock(&codec->spdif_mutex); 2346 2342 spdif = snd_array_elem(&codec->spdif_out, idx); 2347 2343 nid = spdif->nid; ··· 2491 2483 { 2492 2484 struct hda_spdif_out *spdif; 2493 2485 2486 + if (WARN_ON(codec->spdif_out.used <= idx)) 2487 + return; 2494 2488 mutex_lock(&codec->spdif_mutex); 2495 2489 spdif = snd_array_elem(&codec->spdif_out, idx); 2496 2490 spdif->nid = (u16)-1; ··· 2513 2503 struct hda_spdif_out *spdif; 2514 2504 unsigned short val; 2515 2505 2506 + if (WARN_ON(codec->spdif_out.used <= idx)) 2507 + return; 2516 2508 mutex_lock(&codec->spdif_mutex); 2517 2509 spdif = snd_array_elem(&codec->spdif_out, idx); 2518 2510 if (spdif->nid != nid) {