ASoC: ops: Validate input values in snd_soc_put_volsw_range()

[ Upstream commit aa22125c57f9e577f0a667e4fa07fc3fa8ca1e60 ]

Check that values written via snd_soc_put_volsw_range() are
within the range advertised by the control, ensuring that we
don't write out of spec values to the hardware.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20220423131239.3375261-1-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
index 63ee35e..f32ba64 100644 (file)
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -519,7 +519,15 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
        unsigned int mask = (1 << fls(max)) - 1;
        unsigned int invert = mc->invert;
        unsigned int val, val_mask;
-       int err, ret;
+       int err, ret, tmp;
+
+       tmp = ucontrol->value.integer.value[0];
+       if (tmp < 0)
+               return -EINVAL;
+       if (mc->platform_max && tmp > mc->platform_max)
+               return -EINVAL;
+       if (tmp > mc->max - mc->min + 1)
+               return -EINVAL;
 
        if (invert)
                val = (max - ucontrol->value.integer.value[0]) & mask;
@@ -534,6 +542,14 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
        ret = err;
 
        if (snd_soc_volsw_is_stereo(mc)) {
+               tmp = ucontrol->value.integer.value[1];
+               if (tmp < 0)
+                       return -EINVAL;
+               if (mc->platform_max && tmp > mc->platform_max)
+                       return -EINVAL;
+               if (tmp > mc->max - mc->min + 1)
+                       return -EINVAL;
+
                if (invert)
                        val = (max - ucontrol->value.integer.value[1]) & mask;
                else