Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit 669982364299f6f22bea4324f0f7ee8f8a361b87

Authored by Lars-Peter Clausen
Committed by Jiri Slaby
1 parent 0bf595fd31
Exists in ti-linux-3.12.y and in 2 other branches newt-ti-linux-3.12.y, smarc-ti-linux-3.12.y

ALSA: control: Handle numid overflow 

commit ac902c112d90a89e59916f751c2745f4dbdbb4bd upstream.

Each control gets automatically assigned its numids when the control is created.
The allocation is done by incrementing the numid by the amount of allocated
numids per allocation. This means that excessive creation and destruction of
controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
eventually overflow. Currently when this happens for the control that caused the
overflow kctl->id.numid + kctl->count will also over flow causing it to be
smaller than kctl->id.numid. Most of the code assumes that this is something
that can not happen, so we need to make sure that it won't happen

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>

Showing 1 changed file with 4 additions and 0 deletions Side-by-side Diff

sound/core/control.c
Diff comments   View file @ 6699823
... ... @@ -289,6 +289,10 @@
289 289 {
290 290 struct snd_kcontrol *kctl;
291 291  
  292 + /* Make sure that the ids assigned to the control do not wrap around */
  293 + if (card->last_numid >= UINT_MAX - count)
  294 + card->last_numid = 0;
  295 +
292 296 list_for_each_entry(kctl, &card->controls, list) {
293 297 if (kctl->id.numid < card->last_numid + 1 + count &&
294 298 kctl->id.numid + kctl->count > card->last_numid + 1) {