diff options
| author | Takashi Iwai <tiwai@suse.de> | 2020-12-11 14:00:48 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-12-29 13:46:46 +0100 |
| commit | 6dcda2aaab3c673132afa8c6fcf81a0023d9947d (patch) | |
| tree | ec78498b5a02fd80549e37a667f4c0b7e47dd097 /sound/usb/stream.c | |
| parent | b5ac73ed84d634a0ba528435ffaeefa2a81f2253 (diff) | |
| download | linux-rt-6dcda2aaab3c673132afa8c6fcf81a0023d9947d.tar.gz | |
ALSA: usb-audio: Fix control 'access overflow' errors from chmap
commit c6dde8ffd071aea9d1ce64279178e470977b235c upstream.
The current channel-map control implementation in USB-audio driver may
lead to an error message like
"control 3:0:0:Playback Channel Map:0: access overflow"
when CONFIG_SND_CTL_VALIDATION is set. It's because the chmap get
callback clears the whole array no matter which count is set, and
rather the false-positive detection.
This patch fixes the problem by clearing only the needed array range
at usb_chmap_ctl_get().
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201211130048.6358-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'sound/usb/stream.c')
| -rw-r--r-- | sound/usb/stream.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sound/usb/stream.c b/sound/usb/stream.c index 452646959586..7b86bf38f10e 100644 --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -185,16 +185,16 @@ static int usb_chmap_ctl_get(struct snd_kcontrol *kcontrol, struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol); struct snd_usb_substream *subs = info->private_data; struct snd_pcm_chmap_elem *chmap = NULL; - int i; + int i = 0; - memset(ucontrol->value.integer.value, 0, - sizeof(ucontrol->value.integer.value)); if (subs->cur_audiofmt) chmap = subs->cur_audiofmt->chmap; if (chmap) { for (i = 0; i < chmap->channels; i++) ucontrol->value.integer.value[i] = chmap->map[i]; } + for (; i < subs->channels_max; i++) + ucontrol->value.integer.value[i] = 0; return 0; } |