Commit d05ab185 authored by Takashi Iwai's avatar Takashi Iwai Committed by Jaroslav Kysela
Browse files

[ALSA] vxpocket - Check value range in ctl callbacks 



Check the value ranges in ctl put callbacks in vxpocket driver.

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarJaroslav Kysela <perex@perex.cz>
parent 9c45ba10

sound/drivers/vx/vx_mixer.c

+48 −19
Original line number Diff line number Diff line
@@ -439,14 +439,19 @@ static int vx_output_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_ele 
{

	struct vx_core *chip = snd_kcontrol_chip(kcontrol);

	int codec = kcontrol->id.index;

	unsigned int val[2], vmax;



	vmax = chip->hw->output_level_max;

	val[0] = ucontrol->value.integer.value[0];

	val[1] = ucontrol->value.integer.value[1];

	if (val[0] > vmax || val[1] > vmax)

		return -EINVAL;

	mutex_lock(&chip->mixer_mutex);

	if (ucontrol->value.integer.value[0] != chip->output_level[codec][0] ||

	    ucontrol->value.integer.value[1] != chip->output_level[codec][1]) {

		vx_set_analog_output_level(chip, codec,

					   ucontrol->value.integer.value[0],

					   ucontrol->value.integer.value[1]);

		chip->output_level[codec][0] = ucontrol->value.integer.value[0];

		chip->output_level[codec][1] = ucontrol->value.integer.value[1];

	if (val[0] != chip->output_level[codec][0] ||

	    val[1] != chip->output_level[codec][1]) {

		vx_set_analog_output_level(chip, codec, val[0], val[1]);

		chip->output_level[codec][0] = val[0];

		chip->output_level[codec][1] = val[1];

		mutex_unlock(&chip->mixer_mutex);

		return 1;

	}
@@ -506,6 +511,14 @@ static int vx_audio_src_get(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v 
static int vx_audio_src_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol)

{

	struct vx_core *chip = snd_kcontrol_chip(kcontrol);



	if (chip->type >= VX_TYPE_VXPOCKET) {

		if (ucontrol->value.enumerated.item[0] > 2)

			return -EINVAL;

	} else {

		if (ucontrol->value.enumerated.item[0] > 1)

			return -EINVAL;

	}

	mutex_lock(&chip->mixer_mutex);

	if (chip->audio_source_target != ucontrol->value.enumerated.item[0]) {

		chip->audio_source_target = ucontrol->value.enumerated.item[0];
@@ -554,6 +567,9 @@ static int vx_clock_mode_get(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ 
static int vx_clock_mode_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol)

{

	struct vx_core *chip = snd_kcontrol_chip(kcontrol);



	if (ucontrol->value.enumerated.item[0] > 2)

		return -EINVAL;

	mutex_lock(&chip->mixer_mutex);

	if (chip->clock_mode != ucontrol->value.enumerated.item[0]) {

		chip->clock_mode = ucontrol->value.enumerated.item[0];
@@ -603,12 +619,17 @@ static int vx_audio_gain_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ 
	struct vx_core *chip = snd_kcontrol_chip(kcontrol);

	int audio = kcontrol->private_value & 0xff;

	int capture = (kcontrol->private_value >> 8) & 1;

	unsigned int val[2];



	val[0] = ucontrol->value.integer.value[0];

	val[1] = ucontrol->value.integer.value[1];

	if (val[0] > CVAL_MAX || val[1] > CVAL_MAX)

		return -EINVAL;

	mutex_lock(&chip->mixer_mutex);

	if (ucontrol->value.integer.value[0] != chip->audio_gain[capture][audio] ||

	    ucontrol->value.integer.value[1] != chip->audio_gain[capture][audio+1]) {

		vx_set_audio_gain(chip, audio, capture, ucontrol->value.integer.value[0]);

		vx_set_audio_gain(chip, audio+1, capture, ucontrol->value.integer.value[1]);

	if (val[0] != chip->audio_gain[capture][audio] ||

	    val[1] != chip->audio_gain[capture][audio+1]) {

		vx_set_audio_gain(chip, audio, capture, val[0]);

		vx_set_audio_gain(chip, audio+1, capture, val[1]);

		mutex_unlock(&chip->mixer_mutex);

		return 1;

	}
@@ -632,13 +653,19 @@ static int vx_audio_monitor_put(struct snd_kcontrol *kcontrol, struct snd_ctl_el 
{

	struct vx_core *chip = snd_kcontrol_chip(kcontrol);

	int audio = kcontrol->private_value & 0xff;

	unsigned int val[2];



	val[0] = ucontrol->value.integer.value[0];

	val[1] = ucontrol->value.integer.value[1];

	if (val[0] > CVAL_MAX || val[1] > CVAL_MAX)

		return -EINVAL;



	mutex_lock(&chip->mixer_mutex);

	if (ucontrol->value.integer.value[0] != chip->audio_monitor[audio] ||

	    ucontrol->value.integer.value[1] != chip->audio_monitor[audio+1]) {

		vx_set_monitor_level(chip, audio, ucontrol->value.integer.value[0],

	if (val[0] != chip->audio_monitor[audio] ||

	    val[1] != chip->audio_monitor[audio+1]) {

		vx_set_monitor_level(chip, audio, val[0],

				     chip->audio_monitor_active[audio]);

		vx_set_monitor_level(chip, audio+1, ucontrol->value.integer.value[1],

		vx_set_monitor_level(chip, audio+1, val[1],

				     chip->audio_monitor_active[audio+1]);

		mutex_unlock(&chip->mixer_mutex);

		return 1;
@@ -669,8 +696,10 @@ static int vx_audio_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_va 
	mutex_lock(&chip->mixer_mutex);

	if (ucontrol->value.integer.value[0] != chip->audio_active[audio] ||

	    ucontrol->value.integer.value[1] != chip->audio_active[audio+1]) {

		vx_set_audio_switch(chip, audio, ucontrol->value.integer.value[0]);

		vx_set_audio_switch(chip, audio+1, ucontrol->value.integer.value[1]);

		vx_set_audio_switch(chip, audio,

				    !!ucontrol->value.integer.value[0]);

		vx_set_audio_switch(chip, audio+1,

				    !!ucontrol->value.integer.value[1]);

		mutex_unlock(&chip->mixer_mutex);

		return 1;

	}
@@ -699,9 +728,9 @@ static int vx_monitor_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ 
	if (ucontrol->value.integer.value[0] != chip->audio_monitor_active[audio] ||

	    ucontrol->value.integer.value[1] != chip->audio_monitor_active[audio+1]) {

		vx_set_monitor_level(chip, audio, chip->audio_monitor[audio],

				     ucontrol->value.integer.value[0]);

				     !!ucontrol->value.integer.value[0]);

		vx_set_monitor_level(chip, audio+1, chip->audio_monitor[audio+1],

				     ucontrol->value.integer.value[1]);

				     !!ucontrol->value.integer.value[1]);

		mutex_unlock(&chip->mixer_mutex);

		return 1;

	}

sound/pcmcia/vx/vxp_mixer.c

+8 −3
Original line number Diff line number Diff line
@@ -53,6 +53,10 @@ static int vx_mic_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v 
{

	struct vx_core *_chip = snd_kcontrol_chip(kcontrol);

	struct snd_vxpocket *chip = (struct snd_vxpocket *)_chip;

	unsigned int val = ucontrol->value.integer.value[0];



	if (val > MIC_LEVEL_MAX)

		return -EINVAL;

	mutex_lock(&_chip->mixer_mutex);

	if (chip->mic_level != ucontrol->value.integer.value[0]) {

		vx_set_mic_level(_chip, ucontrol->value.integer.value[0]);
@@ -94,10 +98,11 @@ static int vx_mic_boost_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v 
{

	struct vx_core *_chip = snd_kcontrol_chip(kcontrol);

	struct snd_vxpocket *chip = (struct snd_vxpocket *)_chip;

	int val = !!ucontrol->value.integer.value[0];

	mutex_lock(&_chip->mixer_mutex);

	if (chip->mic_level != ucontrol->value.integer.value[0]) {

		vx_set_mic_boost(_chip, ucontrol->value.integer.value[0]);

		chip->mic_level = ucontrol->value.integer.value[0];

	if (chip->mic_level != val) {

		vx_set_mic_boost(_chip, val);

		chip->mic_level = val;

		mutex_unlock(&_chip->mixer_mutex);

		return 1;

	}