| From | Greg Kroah-Hartman <> | Subject | [PATCH 4.4 016/132] ALSA: usb-audio: Fix control access overflow errors from chmap | Date | Mon, 28 Dec 2020 13:48:20 +0100 |
| |
From: Takashi Iwai <tiwai@suse.de>
commit c6dde8ffd071aea9d1ce64279178e470977b235c upstream.
The current channel-map control implementation in USB-audio driver may lead to an error message like "control 3:0:0:Playback Channel Map:0: access overflow" when CONFIG_SND_CTL_VALIDATION is set. It's because the chmap get callback clears the whole array no matter which count is set, and rather the false-positive detection.
This patch fixes the problem by clearing only the needed array range at usb_chmap_ctl_get().
Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20201211130048.6358-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
--- sound/usb/stream.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -187,16 +187,16 @@ static int usb_chmap_ctl_get(struct snd_ struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol); struct snd_usb_substream *subs = info->private_data; struct snd_pcm_chmap_elem *chmap = NULL; - int i; + int i = 0; - memset(ucontrol->value.integer.value, 0, - sizeof(ucontrol->value.integer.value)); if (subs->cur_audiofmt) chmap = subs->cur_audiofmt->chmap; if (chmap) { for (i = 0; i < chmap->channels; i++) ucontrol->value.integer.value[i] = chmap->map[i]; } + for (; i < subs->channels_max; i++) + ucontrol->value.integer.value[i] = 0; return 0; }
|