• Takashi Iwai's avatar
    ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write · 7194eda1
    Takashi Iwai authored
    The function snd_ac97_put_spsa() gets the bit shift value from the
    associated private_value, but it extracts too much; the current code
    extracts 8 bit values in bits 8-15, but this is a combination of two
    nibbles (bits 8-11 and bits 12-15) for left and right shifts.
    Due to the incorrect bits extraction, the actual shift may go beyond
    the 32bit value, as spotted recently by UBSAN check:
     UBSAN: Undefined behaviour in sound/pci/ac97/ac97_codec.c:836:7
     shift exponent 68 is too large for 32-bit type 'int'
    
    This patch fixes the shift value extraction by masking the properly
    with 0x0f instead of 0xff.
    Reported-and-tested-by: default avatarMeelis Roos <mroos@linux.ee>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai's avatarTakashi Iwai <tiwai@suse.de>
    7194eda1
ac97_codec.c 93.4 KB