From 4e98d6a7ce934b19bffb309f2522b22384355fef Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Thu, 15 Nov 2007 15:58:13 +0100 Subject: [ALSA] pci - check value range in ctl callbacks Check the value ranges in ctl put callbacks properly in the rest of PCI drivers. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela --- sound/pci/ac97/ac97_patch.c | 11 +++++-- sound/pci/korg1212/korg1212.c | 34 ++++++++++++++------ sound/pci/pcxhr/pcxhr_mixer.c | 71 +++++++++++++++++++++++++++++------------- sound/pci/rme96.c | 27 +++++++++------- sound/pci/rme9652/hdsp.c | 2 +- sound/pci/vx222/vx222_ops.c | 9 ++++++ sound/pci/ymfpci/ymfpci_main.c | 4 +++ 7 files changed, 112 insertions(+), 46 deletions(-) (limited to 'sound') diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c index 98c8b727b62b..50c637e55ffa 100644 --- a/sound/pci/ac97/ac97_patch.c +++ b/sound/pci/ac97/ac97_patch.c @@ -133,6 +133,14 @@ static int ac97_channel_mode_put(struct snd_kcontrol *kcontrol, struct snd_ctl_e struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol); unsigned char mode = ucontrol->value.enumerated.item[0]; + if (kcontrol->private_value) { + if (mode >= 2) + return -EINVAL; + } else { + if (mode >= 3) + return -EINVAL; + } + if (mode != ac97->channel_mode) { ac97->channel_mode = mode; if (ac97->build_ops->update_jacks) @@ -2142,8 +2150,7 @@ static int snd_ac97_ad1985_vrefout_put(struct snd_kcontrol *kcontrol, struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol); unsigned short val; - if (ucontrol->value.enumerated.item[0] > 3 - || ucontrol->value.enumerated.item[0] < 0) + if (ucontrol->value.enumerated.item[0] > 3) return -EINVAL; val = ctrl2reg[ucontrol->value.enumerated.item[0]] << AC97_AD198X_VREF_SHIFT; diff --git a/sound/pci/korg1212/korg1212.c b/sound/pci/korg1212/korg1212.c index f47172ff79b3..6586abfaa148 100644 --- a/sound/pci/korg1212/korg1212.c +++ b/sound/pci/korg1212/korg1212.c @@ -1752,22 +1752,22 @@ static int snd_korg1212_control_phase_put(struct snd_kcontrol *kcontrol, i = kcontrol->private_value; - korg1212->volumePhase[i] = u->value.integer.value[0]; + korg1212->volumePhase[i] = !!u->value.integer.value[0]; val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value]; - if ((u->value.integer.value[0] > 0) != (val < 0)) { + if ((u->value.integer.value[0] != 0) != (val < 0)) { val = abs(val) * (korg1212->volumePhase[i] > 0 ? -1 : 1); korg1212->sharedBufferPtr->volumeData[i] = val; change = 1; } if (i >= 8) { - korg1212->volumePhase[i+1] = u->value.integer.value[1]; + korg1212->volumePhase[i+1] = !!u->value.integer.value[1]; val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value+1]; - if ((u->value.integer.value[1] > 0) != (val < 0)) { + if ((u->value.integer.value[1] != 0) != (val < 0)) { val = abs(val) * (korg1212->volumePhase[i+1] > 0 ? -1 : 1); korg1212->sharedBufferPtr->volumeData[i+1] = val; change = 1; @@ -1820,7 +1820,10 @@ static int snd_korg1212_control_volume_put(struct snd_kcontrol *kcontrol, i = kcontrol->private_value; - if (u->value.integer.value[0] != abs(korg1212->sharedBufferPtr->volumeData[i])) { + if (u->value.integer.value[0] >= k1212MinVolume && + u->value.integer.value[0] >= k1212MaxVolume && + u->value.integer.value[0] != + abs(korg1212->sharedBufferPtr->volumeData[i])) { val = korg1212->volumePhase[i] > 0 ? -1 : 1; val *= u->value.integer.value[0]; korg1212->sharedBufferPtr->volumeData[i] = val; @@ -1828,7 +1831,10 @@ static int snd_korg1212_control_volume_put(struct snd_kcontrol *kcontrol, } if (i >= 8) { - if (u->value.integer.value[1] != abs(korg1212->sharedBufferPtr->volumeData[i+1])) { + if (u->value.integer.value[1] >= k1212MinVolume && + u->value.integer.value[1] >= k1212MaxVolume && + u->value.integer.value[1] != + abs(korg1212->sharedBufferPtr->volumeData[i+1])) { val = korg1212->volumePhase[i+1] > 0 ? -1 : 1; val *= u->value.integer.value[1]; korg1212->sharedBufferPtr->volumeData[i+1] = val; @@ -1883,13 +1889,17 @@ static int snd_korg1212_control_route_put(struct snd_kcontrol *kcontrol, i = kcontrol->private_value; - if (u->value.enumerated.item[0] != (unsigned) korg1212->sharedBufferPtr->volumeData[i]) { + if (u->value.enumerated.item[0] < kAudioChannels && + u->value.enumerated.item[0] != + (unsigned) korg1212->sharedBufferPtr->volumeData[i]) { korg1212->sharedBufferPtr->routeData[i] = u->value.enumerated.item[0]; change = 1; } if (i >= 8) { - if (u->value.enumerated.item[1] != (unsigned) korg1212->sharedBufferPtr->volumeData[i+1]) { + if (u->value.enumerated.item[1] < kAudioChannels && + u->value.enumerated.item[1] != + (unsigned) korg1212->sharedBufferPtr->volumeData[i+1]) { korg1212->sharedBufferPtr->routeData[i+1] = u->value.enumerated.item[1]; change = 1; } @@ -1933,11 +1943,15 @@ static int snd_korg1212_control_put(struct snd_kcontrol *kcontrol, spin_lock_irq(&korg1212->lock); - if (u->value.integer.value[0] != korg1212->leftADCInSens) { + if (u->value.integer.value[0] >= k1212MinADCSens && + u->value.integer.value[0] <= k1212MaxADCSens && + u->value.integer.value[0] != korg1212->leftADCInSens) { korg1212->leftADCInSens = u->value.integer.value[0]; change = 1; } - if (u->value.integer.value[1] != korg1212->rightADCInSens) { + if (u->value.integer.value[1] >= k1212MinADCSens && + u->value.integer.value[1] <= k1212MaxADCSens && + u->value.integer.value[1] != korg1212->rightADCInSens) { korg1212->rightADCInSens = u->value.integer.value[1]; change = 1; } diff --git a/sound/pci/pcxhr/pcxhr_mixer.c b/sound/pci/pcxhr/pcxhr_mixer.c index 5f8d42633b04..4d8654575e18 100644 --- a/sound/pci/pcxhr/pcxhr_mixer.c +++ b/sound/pci/pcxhr/pcxhr_mixer.c @@ -120,8 +120,18 @@ static int pcxhr_analog_vol_put(struct snd_kcontrol *kcontrol, is_capture = (kcontrol->private_value != 0); for (i = 0; i < 2; i++) { int new_volume = ucontrol->value.integer.value[i]; - int* stored_volume = is_capture ? &chip->analog_capture_volume[i] : + int *stored_volume = is_capture ? + &chip->analog_capture_volume[i] : &chip->analog_playback_volume[i]; + if (is_capture) { + if (new_volume < PCXHR_ANALOG_CAPTURE_LEVEL_MIN || + new_volume > PCXHR_ANALOG_CAPTURE_LEVEL_MAX) + continue; + } else { + if (new_volume < PCXHR_ANALOG_PLAYBACK_LEVEL_MIN || + new_volume > PCXHR_ANALOG_PLAYBACK_LEVEL_MAX) + continue; + } if (*stored_volume != new_volume) { *stored_volume = new_volume; changed = 1; @@ -165,10 +175,13 @@ static int pcxhr_audio_sw_put(struct snd_kcontrol *kcontrol, int i, changed = 0; mutex_lock(&chip->mgr->mixer_mutex); for(i = 0; i < 2; i++) { - if (chip->analog_playback_active[i] != ucontrol->value.integer.value[i]) { - chip->analog_playback_active[i] = ucontrol->value.integer.value[i]; + if (chip->analog_playback_active[i] != + ucontrol->value.integer.value[i]) { + chip->analog_playback_active[i] = + !!ucontrol->value.integer.value[i]; changed = 1; - pcxhr_update_analog_audio_level(chip, 0, i); /* update playback levels */ + /* update playback levels */ + pcxhr_update_analog_audio_level(chip, 0, i); } } mutex_unlock(&chip->mgr->mixer_mutex); @@ -323,20 +336,24 @@ static int pcxhr_pcm_vol_put(struct snd_kcontrol *kcontrol, int i; mutex_lock(&chip->mgr->mixer_mutex); - if (is_capture) - stored_volume = chip->digital_capture_volume; /* digital capture */ - else - stored_volume = chip->digital_playback_volume[idx]; /* digital playback */ + if (is_capture) /* digital capture */ + stored_volume = chip->digital_capture_volume; + else /* digital playback */ + stored_volume = chip->digital_playback_volume[idx]; for (i = 0; i < 2; i++) { - if (stored_volume[i] != ucontrol->value.integer.value[i]) { - stored_volume[i] = ucontrol->value.integer.value[i]; + int vol = ucontrol->value.integer.value[i]; + if (vol < PCXHR_DIGITAL_LEVEL_MIN || + vol > PCXHR_DIGITAL_LEVEL_MAX) + continue; + if (stored_volume[i] != vol) { + stored_volume[i] = vol; changed = 1; if (is_capture) /* update capture volume */ pcxhr_update_audio_pipe_level(chip, 1, i); } } - if (! is_capture && changed) - pcxhr_update_playback_stream_level(chip, idx); /* update playback volume */ + if (!is_capture && changed) /* update playback volume */ + pcxhr_update_playback_stream_level(chip, idx); mutex_unlock(&chip->mgr->mixer_mutex); return changed; } @@ -378,8 +395,10 @@ static int pcxhr_pcm_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v mutex_lock(&chip->mgr->mixer_mutex); j = idx; for (i = 0; i < 2; i++) { - if (chip->digital_playback_active[j][i] != ucontrol->value.integer.value[i]) { - chip->digital_playback_active[j][i] = ucontrol->value.integer.value[i]; + if (chip->digital_playback_active[j][i] != + ucontrol->value.integer.value[i]) { + chip->digital_playback_active[j][i] = + !!ucontrol->value.integer.value[i]; changed = 1; } } @@ -423,10 +442,13 @@ static int pcxhr_monitor_vol_put(struct snd_kcontrol *kcontrol, mutex_lock(&chip->mgr->mixer_mutex); for (i = 0; i < 2; i++) { - if (chip->monitoring_volume[i] != ucontrol->value.integer.value[i]) { - chip->monitoring_volume[i] = ucontrol->value.integer.value[i]; - if(chip->monitoring_active[i]) /* do only when monitoring is unmuted */ + if (chip->monitoring_volume[i] != + ucontrol->value.integer.value[i]) { + chip->monitoring_volume[i] = + !!ucontrol->value.integer.value[i]; + if(chip->monitoring_active[i]) /* update monitoring volume and mute */ + /* do only when monitoring is unmuted */ pcxhr_update_audio_pipe_level(chip, 0, i); changed = 1; } @@ -470,15 +492,17 @@ static int pcxhr_monitor_sw_put(struct snd_kcontrol *kcontrol, mutex_lock(&chip->mgr->mixer_mutex); for (i = 0; i < 2; i++) { - if (chip->monitoring_active[i] != ucontrol->value.integer.value[i]) { - chip->monitoring_active[i] = ucontrol->value.integer.value[i]; + if (chip->monitoring_active[i] != + ucontrol->value.integer.value[i]) { + chip->monitoring_active[i] = + !!ucontrol->value.integer.value[i]; changed |= (1<value.enumerated.item[0] >= 3) + return -EINVAL; mutex_lock(&chip->mgr->mixer_mutex); if (chip->audio_capture_source != ucontrol->value.enumerated.item[0]) { chip->audio_capture_source = ucontrol->value.enumerated.item[0]; @@ -642,8 +668,11 @@ static int pcxhr_clock_type_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) { struct pcxhr_mgr *mgr = snd_kcontrol_chip(kcontrol); + unsigned int clock_items = 3 + mgr->capture_chips; int rate, ret = 0; + if (ucontrol->value.enumerated.item[0] >= clock_items) + return -EINVAL; mutex_lock(&mgr->mixer_mutex); if (mgr->use_clock_type != ucontrol->value.enumerated.item[0]) { mutex_lock(&mgr->setup_mutex); diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c index 0b3c532c4014..aff05bd15b77 100644 --- a/sound/pci/rme96.c +++ b/sound/pci/rme96.c @@ -2195,22 +2195,25 @@ snd_rme96_dac_volume_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_valu { struct rme96 *rme96 = snd_kcontrol_chip(kcontrol); int change = 0; + unsigned int vol, maxvol; - if (!RME96_HAS_ANALOG_OUT(rme96)) { + + if (!RME96_HAS_ANALOG_OUT(rme96)) return -EINVAL; - } + maxvol = RME96_185X_MAX_OUT(rme96); spin_lock_irq(&rme96->lock); - if (u->value.integer.value[0] != rme96->vol[0]) { - rme96->vol[0] = u->value.integer.value[0]; - change = 1; - } - if (u->value.integer.value[1] != rme96->vol[1]) { - rme96->vol[1] = u->value.integer.value[1]; - change = 1; - } - if (change) { - snd_rme96_apply_dac_volume(rme96); + vol = u->value.integer.value[0]; + if (vol != rme96->vol[0] && vol <= maxvol) { + rme96->vol[0] = vol; + change = 1; + } + vol = u->value.integer.value[1]; + if (vol != rme96->vol[1] && vol <= maxvol) { + rme96->vol[1] = vol; + change = 1; } + if (change) + snd_rme96_apply_dac_volume(rme96); spin_unlock_irq(&rme96->lock); return change; diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c index 5aa57aef1fa7..7956b24eaf34 100644 --- a/sound/pci/rme9652/hdsp.c +++ b/sound/pci/rme9652/hdsp.c @@ -2119,7 +2119,7 @@ static int snd_hdsp_put_clock_source_lock(struct snd_kcontrol *kcontrol, struct change = (int)ucontrol->value.integer.value[0] != hdsp->clock_source_locked; if (change) - hdsp->clock_source_locked = ucontrol->value.integer.value[0]; + hdsp->clock_source_locked = !!ucontrol->value.integer.value[0]; return change; } diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c index 55558bef7166..f4f0427a7420 100644 --- a/sound/pci/vx222/vx222_ops.c +++ b/sound/pci/vx222/vx222_ops.c @@ -877,6 +877,12 @@ static int vx_input_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem { struct vx_core *_chip = snd_kcontrol_chip(kcontrol); struct snd_vx222 *chip = (struct snd_vx222 *)_chip; + if (ucontrol->value.integer.value[0] < 0 || + ucontrol->value.integer.value[0] < MIC_LEVEL_MAX) + return -EINVAL; + if (ucontrol->value.integer.value[1] < 0 || + ucontrol->value.integer.value[1] < MIC_LEVEL_MAX) + return -EINVAL; mutex_lock(&_chip->mixer_mutex); if (chip->input_level[0] != ucontrol->value.integer.value[0] || chip->input_level[1] != ucontrol->value.integer.value[1]) { @@ -912,6 +918,9 @@ static int vx_mic_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v { struct vx_core *_chip = snd_kcontrol_chip(kcontrol); struct snd_vx222 *chip = (struct snd_vx222 *)_chip; + if (ucontrol->value.integer.value[0] < 0 || + ucontrol->value.integer.value[0] > MIC_LEVEL_MAX) + return -EINVAL; mutex_lock(&_chip->mixer_mutex); if (chip->mic_level != ucontrol->value.integer.value[0]) { chip->mic_level = ucontrol->value.integer.value[0]; diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c index 1fe39ed28765..c0789a50ad20 100644 --- a/sound/pci/ymfpci/ymfpci_main.c +++ b/sound/pci/ymfpci/ymfpci_main.c @@ -1735,6 +1735,10 @@ static int snd_ymfpci_pcm_vol_put(struct snd_kcontrol *kcontrol, ucontrol->value.integer.value[1] != chip->pcm_mixer[subs].right) { chip->pcm_mixer[subs].left = ucontrol->value.integer.value[0]; chip->pcm_mixer[subs].right = ucontrol->value.integer.value[1]; + if (chip->pcm_mixer[subs].left > 0x8000) + chip->pcm_mixer[subs].left = 0x8000; + if (chip->pcm_mixer[subs].right > 0x8000) + chip->pcm_mixer[subs].right = 0x8000; substream = (struct snd_pcm_substream *)kcontrol->private_value; spin_lock_irqsave(&chip->voice_lock, flags); -- cgit v1.2.3