[ALSA] pci - check value range in ctl callbacks

Check the value ranges in ctl put callbacks properly in the rest of
PCI drivers.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>

diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
index 98c8b727b62b8c006f040a711125cac1f2a50ba6..50c637e55ffa63ef544646fae65e62a29b049c7b 100644 (file)
--- a/sound/pci/ac97/ac97_patch.c
+++ b/sound/pci/ac97/ac97_patch.c
@@ -133,6 +133,14 @@ static int ac97_channel_mode_put(struct snd_kcontrol *kcontrol, struct snd_ctl_e
        struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
        unsigned char mode = ucontrol->value.enumerated.item[0];
 
+       if (kcontrol->private_value) {
+               if (mode >= 2)
+                       return -EINVAL;
+       } else {
+               if (mode >= 3)
+                       return -EINVAL;
+       }
+
        if (mode != ac97->channel_mode) {
                ac97->channel_mode = mode;
                if (ac97->build_ops->update_jacks)
@@ -2142,8 +2150,7 @@ static int snd_ac97_ad1985_vrefout_put(struct snd_kcontrol *kcontrol,
        struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
        unsigned short val;
 
-       if (ucontrol->value.enumerated.item[0] > 3
-           || ucontrol->value.enumerated.item[0] < 0)
+       if (ucontrol->value.enumerated.item[0] > 3)
                return -EINVAL;
        val = ctrl2reg[ucontrol->value.enumerated.item[0]]
              << AC97_AD198X_VREF_SHIFT;

diff --git a/sound/pci/korg1212/korg1212.c b/sound/pci/korg1212/korg1212.c
index f47172ff79b3edfa069e1942fa35fcb9059784af..6586abfaa148969dd40ceb5eab870d31c23e11f8 100644 (file)
--- a/sound/pci/korg1212/korg1212.c
+++ b/sound/pci/korg1212/korg1212.c
@@ -1752,22 +1752,22 @@ static int snd_korg1212_control_phase_put(struct snd_kcontrol *kcontrol,
 
        i = kcontrol->private_value;
 
-       korg1212->volumePhase[i] = u->value.integer.value[0];
+       korg1212->volumePhase[i] = !!u->value.integer.value[0];
 
        val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value];
 
-       if ((u->value.integer.value[0] > 0) != (val < 0)) {
+       if ((u->value.integer.value[0] != 0) != (val < 0)) {
                val = abs(val) * (korg1212->volumePhase[i] > 0 ? -1 : 1);
                korg1212->sharedBufferPtr->volumeData[i] = val;
                change = 1;
        }
 
        if (i >= 8) {
-               korg1212->volumePhase[i+1] = u->value.integer.value[1];
+               korg1212->volumePhase[i+1] = !!u->value.integer.value[1];
 
                val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value+1];
 
-               if ((u->value.integer.value[1] > 0) != (val < 0)) {
+               if ((u->value.integer.value[1] != 0) != (val < 0)) {
                        val = abs(val) * (korg1212->volumePhase[i+1] > 0 ? -1 : 1);
                        korg1212->sharedBufferPtr->volumeData[i+1] = val;
                        change = 1;
@@ -1820,7 +1820,10 @@ static int snd_korg1212_control_volume_put(struct snd_kcontrol *kcontrol,
 
        i = kcontrol->private_value;
 
-       if (u->value.integer.value[0] != abs(korg1212->sharedBufferPtr->volumeData[i])) {
+       if (u->value.integer.value[0] >= k1212MinVolume && 
+           u->value.integer.value[0] >= k1212MaxVolume &&
+           u->value.integer.value[0] !=
+           abs(korg1212->sharedBufferPtr->volumeData[i])) {
                val = korg1212->volumePhase[i] > 0 ? -1 : 1;
                val *= u->value.integer.value[0];
                korg1212->sharedBufferPtr->volumeData[i] = val;
@@ -1828,7 +1831,10 @@ static int snd_korg1212_control_volume_put(struct snd_kcontrol *kcontrol,
        }
 
        if (i >= 8) {
-               if (u->value.integer.value[1] != abs(korg1212->sharedBufferPtr->volumeData[i+1])) {
+               if (u->value.integer.value[1] >= k1212MinVolume && 
+                   u->value.integer.value[1] >= k1212MaxVolume &&
+                   u->value.integer.value[1] !=
+                   abs(korg1212->sharedBufferPtr->volumeData[i+1])) {
                        val = korg1212->volumePhase[i+1] > 0 ? -1 : 1;
                        val *= u->value.integer.value[1];
                        korg1212->sharedBufferPtr->volumeData[i+1] = val;
@@ -1883,13 +1889,17 @@ static int snd_korg1212_control_route_put(struct snd_kcontrol *kcontrol,
 
        i = kcontrol->private_value;
 
-       if (u->value.enumerated.item[0] != (unsigned) korg1212->sharedBufferPtr->volumeData[i]) {
+       if (u->value.enumerated.item[0] < kAudioChannels &&
+           u->value.enumerated.item[0] !=
+           (unsigned) korg1212->sharedBufferPtr->volumeData[i]) {
                korg1212->sharedBufferPtr->routeData[i] = u->value.enumerated.item[0];
                change = 1;
        }
 
        if (i >= 8) {
-               if (u->value.enumerated.item[1] != (unsigned) korg1212->sharedBufferPtr->volumeData[i+1]) {
+               if (u->value.enumerated.item[1] < kAudioChannels &&
+                   u->value.enumerated.item[1] !=
+                   (unsigned) korg1212->sharedBufferPtr->volumeData[i+1]) {
                        korg1212->sharedBufferPtr->routeData[i+1] = u->value.enumerated.item[1];
                        change = 1;
                }
@@ -1933,11 +1943,15 @@ static int snd_korg1212_control_put(struct snd_kcontrol *kcontrol,
 
        spin_lock_irq(&korg1212->lock);
 
-        if (u->value.integer.value[0] != korg1212->leftADCInSens) {
+       if (u->value.integer.value[0] >= k1212MinADCSens &&
+           u->value.integer.value[0] <= k1212MaxADCSens &&
+           u->value.integer.value[0] != korg1212->leftADCInSens) {
                 korg1212->leftADCInSens = u->value.integer.value[0];
                 change = 1;
         }
-        if (u->value.integer.value[1] != korg1212->rightADCInSens) {
+       if (u->value.integer.value[1] >= k1212MinADCSens &&
+           u->value.integer.value[1] <= k1212MaxADCSens &&
+           u->value.integer.value[1] != korg1212->rightADCInSens) {
                 korg1212->rightADCInSens = u->value.integer.value[1];
                 change = 1;
         }

diff --git a/sound/pci/pcxhr/pcxhr_mixer.c b/sound/pci/pcxhr/pcxhr_mixer.c
index 5f8d42633b040b92a88b173df5ad4222d2bdcd43..4d8654575e18258dde0b2f17ee3d751128f1a2df 100644 (file)
--- a/sound/pci/pcxhr/pcxhr_mixer.c
+++ b/sound/pci/pcxhr/pcxhr_mixer.c
@@ -120,8 +120,18 @@ static int pcxhr_analog_vol_put(struct snd_kcontrol *kcontrol,
        is_capture = (kcontrol->private_value != 0);
        for (i = 0; i < 2; i++) {
                int  new_volume = ucontrol->value.integer.value[i];
-               int* stored_volume = is_capture ? &chip->analog_capture_volume[i] :
+               int *stored_volume = is_capture ?
+                       &chip->analog_capture_volume[i] :
                        &chip->analog_playback_volume[i];
+               if (is_capture) {
+                       if (new_volume < PCXHR_ANALOG_CAPTURE_LEVEL_MIN ||
+                           new_volume > PCXHR_ANALOG_CAPTURE_LEVEL_MAX)
+                               continue;
+               } else {
+                       if (new_volume < PCXHR_ANALOG_PLAYBACK_LEVEL_MIN ||
+                           new_volume > PCXHR_ANALOG_PLAYBACK_LEVEL_MAX)
+                               continue;
+               }
                if (*stored_volume != new_volume) {
                        *stored_volume = new_volume;
                        changed = 1;
@@ -165,10 +175,13 @@ static int pcxhr_audio_sw_put(struct snd_kcontrol *kcontrol,
        int i, changed = 0;
        mutex_lock(&chip->mgr->mixer_mutex);
        for(i = 0; i < 2; i++) {
-               if (chip->analog_playback_active[i] != ucontrol->value.integer.value[i]) {
-                       chip->analog_playback_active[i] = ucontrol->value.integer.value[i];
+               if (chip->analog_playback_active[i] !=
+                   ucontrol->value.integer.value[i]) {
+                       chip->analog_playback_active[i] =
+                               !!ucontrol->value.integer.value[i];
                        changed = 1;
-                       pcxhr_update_analog_audio_level(chip, 0, i);    /* update playback levels */
+                       /* update playback levels */
+                       pcxhr_update_analog_audio_level(chip, 0, i);
                }
        }
        mutex_unlock(&chip->mgr->mixer_mutex);
@@ -323,20 +336,24 @@ static int pcxhr_pcm_vol_put(struct snd_kcontrol *kcontrol,
        int i;
 
        mutex_lock(&chip->mgr->mixer_mutex);
-       if (is_capture)
-               stored_volume = chip->digital_capture_volume;           /* digital capture */
-       else
-               stored_volume = chip->digital_playback_volume[idx];     /* digital playback */
+       if (is_capture)         /* digital capture */
+               stored_volume = chip->digital_capture_volume;
+       else                    /* digital playback */
+               stored_volume = chip->digital_playback_volume[idx];
        for (i = 0; i < 2; i++) {
-               if (stored_volume[i] != ucontrol->value.integer.value[i]) {
-                       stored_volume[i] = ucontrol->value.integer.value[i];
+               int vol = ucontrol->value.integer.value[i];
+               if (vol < PCXHR_DIGITAL_LEVEL_MIN ||
+                   vol > PCXHR_DIGITAL_LEVEL_MAX)
+                       continue;
+               if (stored_volume[i] != vol) {
+                       stored_volume[i] = vol;
                        changed = 1;
                        if (is_capture) /* update capture volume */
                                pcxhr_update_audio_pipe_level(chip, 1, i);
                }
        }
-       if (! is_capture && changed)
-               pcxhr_update_playback_stream_level(chip, idx);  /* update playback volume */
+       if (!is_capture && changed)     /* update playback volume */
+               pcxhr_update_playback_stream_level(chip, idx);
        mutex_unlock(&chip->mgr->mixer_mutex);
        return changed;
 }
@@ -378,8 +395,10 @@ static int pcxhr_pcm_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
        mutex_lock(&chip->mgr->mixer_mutex);
        j = idx;
        for (i = 0; i < 2; i++) {
-               if (chip->digital_playback_active[j][i] != ucontrol->value.integer.value[i]) {
-                       chip->digital_playback_active[j][i] = ucontrol->value.integer.value[i];
+               if (chip->digital_playback_active[j][i] !=
+                   ucontrol->value.integer.value[i]) {
+                       chip->digital_playback_active[j][i] =
+                               !!ucontrol->value.integer.value[i];
                        changed = 1;
                }
        }
@@ -423,10 +442,13 @@ static int pcxhr_monitor_vol_put(struct snd_kcontrol *kcontrol,
 
        mutex_lock(&chip->mgr->mixer_mutex);
        for (i = 0; i < 2; i++) {
-               if (chip->monitoring_volume[i] != ucontrol->value.integer.value[i]) {
-                       chip->monitoring_volume[i] = ucontrol->value.integer.value[i];
-                       if(chip->monitoring_active[i])  /* do only when monitoring is unmuted */
+               if (chip->monitoring_volume[i] !=
+                   ucontrol->value.integer.value[i]) {
+                       chip->monitoring_volume[i] =
+                               !!ucontrol->value.integer.value[i];
+                       if(chip->monitoring_active[i])
                                /* update monitoring volume and mute */
+                               /* do only when monitoring is unmuted */
                                pcxhr_update_audio_pipe_level(chip, 0, i);
                        changed = 1;
                }
@@ -470,15 +492,17 @@ static int pcxhr_monitor_sw_put(struct snd_kcontrol *kcontrol,
 
        mutex_lock(&chip->mgr->mixer_mutex);
        for (i = 0; i < 2; i++) {
-               if (chip->monitoring_active[i] != ucontrol->value.integer.value[i]) {
-                       chip->monitoring_active[i] = ucontrol->value.integer.value[i];
+               if (chip->monitoring_active[i] !=
+                   ucontrol->value.integer.value[i]) {
+                       chip->monitoring_active[i] =
+                               !!ucontrol->value.integer.value[i];
                        changed |= (1<<i); /* mask 0x01 and 0x02 */
                }
        }
-       if(changed & 0x01)
+       if (changed & 0x01)
                /* update left monitoring volume and mute */
                pcxhr_update_audio_pipe_level(chip, 0, 0);
-       if(changed & 0x02)
+       if (changed & 0x02)
                /* update right monitoring volume and mute */
                pcxhr_update_audio_pipe_level(chip, 0, 1);
 
@@ -579,6 +603,8 @@ static int pcxhr_audio_src_put(struct snd_kcontrol *kcontrol,
        struct snd_pcxhr *chip = snd_kcontrol_chip(kcontrol);
        int ret = 0;
 
+       if (ucontrol->value.enumerated.item[0] >= 3)
+               return -EINVAL;
        mutex_lock(&chip->mgr->mixer_mutex);
        if (chip->audio_capture_source != ucontrol->value.enumerated.item[0]) {
                chip->audio_capture_source = ucontrol->value.enumerated.item[0];
@@ -642,8 +668,11 @@ static int pcxhr_clock_type_put(struct snd_kcontrol *kcontrol,
                                struct snd_ctl_elem_value *ucontrol)
 {
        struct pcxhr_mgr *mgr = snd_kcontrol_chip(kcontrol);
+       unsigned int clock_items = 3 + mgr->capture_chips;
        int rate, ret = 0;
 
+       if (ucontrol->value.enumerated.item[0] >= clock_items)
+               return -EINVAL;
        mutex_lock(&mgr->mixer_mutex);
        if (mgr->use_clock_type != ucontrol->value.enumerated.item[0]) {
                mutex_lock(&mgr->setup_mutex);

diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c
index 0b3c532c4014270e69abe05482e79256777b5af2..aff05bd15b77f4efdef273eab0f60a7cdae5fa32 100644 (file)
--- a/sound/pci/rme96.c
+++ b/sound/pci/rme96.c
@@ -2195,22 +2195,25 @@ snd_rme96_dac_volume_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_valu
 {
        struct rme96 *rme96 = snd_kcontrol_chip(kcontrol);
         int change = 0;
+       unsigned int vol, maxvol;
 
-       if (!RME96_HAS_ANALOG_OUT(rme96)) {
+
+       if (!RME96_HAS_ANALOG_OUT(rme96))
                return -EINVAL;
-       }
+       maxvol = RME96_185X_MAX_OUT(rme96);
        spin_lock_irq(&rme96->lock);
-        if (u->value.integer.value[0] != rme96->vol[0]) {
-               rme96->vol[0] = u->value.integer.value[0];
-                change = 1;
-        }
-        if (u->value.integer.value[1] != rme96->vol[1]) {
-               rme96->vol[1] = u->value.integer.value[1];
-                change = 1;
-        }
-       if (change) {
-               snd_rme96_apply_dac_volume(rme96);
+       vol = u->value.integer.value[0];
+       if (vol != rme96->vol[0] && vol <= maxvol) {
+               rme96->vol[0] = vol;
+               change = 1;
+       }
+       vol = u->value.integer.value[1];
+       if (vol != rme96->vol[1] && vol <= maxvol) {
+               rme96->vol[1] = vol;
+               change = 1;
        }
+       if (change)
+               snd_rme96_apply_dac_volume(rme96);
        spin_unlock_irq(&rme96->lock);
 
         return change;

diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
index 5aa57aef1fa7f99f07b274af7584b56d6f426763..7956b24eaf34116bf7cc1f6894d90e143e692ef4 100644 (file)
--- a/sound/pci/rme9652/hdsp.c
+++ b/sound/pci/rme9652/hdsp.c
@@ -2119,7 +2119,7 @@ static int snd_hdsp_put_clock_source_lock(struct snd_kcontrol *kcontrol, struct
 
        change = (int)ucontrol->value.integer.value[0] != hdsp->clock_source_locked;
        if (change)
-               hdsp->clock_source_locked = ucontrol->value.integer.value[0];
+               hdsp->clock_source_locked = !!ucontrol->value.integer.value[0];
        return change;
 }
 

diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c
index 55558bef7166ff80c7d5d51e21e891160d3dd848..f4f0427a7420b09be67ae70cb351736b4421452c 100644 (file)
--- a/sound/pci/vx222/vx222_ops.c
+++ b/sound/pci/vx222/vx222_ops.c
@@ -877,6 +877,12 @@ static int vx_input_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem
 {
        struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
        struct snd_vx222 *chip = (struct snd_vx222 *)_chip;
+       if (ucontrol->value.integer.value[0] < 0 ||
+           ucontrol->value.integer.value[0] < MIC_LEVEL_MAX)
+               return -EINVAL;
+       if (ucontrol->value.integer.value[1] < 0 ||
+           ucontrol->value.integer.value[1] < MIC_LEVEL_MAX)
+               return -EINVAL;
        mutex_lock(&_chip->mixer_mutex);
        if (chip->input_level[0] != ucontrol->value.integer.value[0] ||
            chip->input_level[1] != ucontrol->value.integer.value[1]) {
@@ -912,6 +918,9 @@ static int vx_mic_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
 {
        struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
        struct snd_vx222 *chip = (struct snd_vx222 *)_chip;
+       if (ucontrol->value.integer.value[0] < 0 ||
+           ucontrol->value.integer.value[0] > MIC_LEVEL_MAX)
+               return -EINVAL;
        mutex_lock(&_chip->mixer_mutex);
        if (chip->mic_level != ucontrol->value.integer.value[0]) {
                chip->mic_level = ucontrol->value.integer.value[0];

diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
index 1fe39ed287657f5a3688725df1313c06ebaafb3b..c0789a50ad209022542e6e3bd3a256146ee87677 100644 (file)
--- a/sound/pci/ymfpci/ymfpci_main.c
+++ b/sound/pci/ymfpci/ymfpci_main.c
@@ -1735,6 +1735,10 @@ static int snd_ymfpci_pcm_vol_put(struct snd_kcontrol *kcontrol,
            ucontrol->value.integer.value[1] != chip->pcm_mixer[subs].right) {
                chip->pcm_mixer[subs].left = ucontrol->value.integer.value[0];
                chip->pcm_mixer[subs].right = ucontrol->value.integer.value[1];
+               if (chip->pcm_mixer[subs].left > 0x8000)
+                       chip->pcm_mixer[subs].left = 0x8000;
+               if (chip->pcm_mixer[subs].right > 0x8000)
+                       chip->pcm_mixer[subs].right = 0x8000;
 
                substream = (struct snd_pcm_substream *)kcontrol->private_value;
                spin_lock_irqsave(&chip->voice_lock, flags);