aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2007-11-15 09:58:13 -0500
committerJaroslav Kysela <perex@perex.cz>2008-01-31 11:29:24 -0500
commit4e98d6a7ce934b19bffb309f2522b22384355fef (patch)
tree8613aee414a855314663de2575f2bee284c8430c
parentab2dac2bdcf562dd616bd1fadddf5078ae7c3d83 (diff)
[ALSA] pci - check value range in ctl callbacks
Check the value ranges in ctl put callbacks properly in the rest of PCI drivers. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
-rw-r--r--sound/pci/ac97/ac97_patch.c11
-rw-r--r--sound/pci/korg1212/korg1212.c34
-rw-r--r--sound/pci/pcxhr/pcxhr_mixer.c71
-rw-r--r--sound/pci/rme96.c27
-rw-r--r--sound/pci/rme9652/hdsp.c2
-rw-r--r--sound/pci/vx222/vx222_ops.c9
-rw-r--r--sound/pci/ymfpci/ymfpci_main.c4
7 files changed, 112 insertions, 46 deletions
diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
index 98c8b727b62b..50c637e55ffa 100644
--- a/sound/pci/ac97/ac97_patch.c
+++ b/sound/pci/ac97/ac97_patch.c
@@ -133,6 +133,14 @@ static int ac97_channel_mode_put(struct snd_kcontrol *kcontrol, struct snd_ctl_e
133 struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol); 133 struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
134 unsigned char mode = ucontrol->value.enumerated.item[0]; 134 unsigned char mode = ucontrol->value.enumerated.item[0];
135 135
136 if (kcontrol->private_value) {
137 if (mode >= 2)
138 return -EINVAL;
139 } else {
140 if (mode >= 3)
141 return -EINVAL;
142 }
143
136 if (mode != ac97->channel_mode) { 144 if (mode != ac97->channel_mode) {
137 ac97->channel_mode = mode; 145 ac97->channel_mode = mode;
138 if (ac97->build_ops->update_jacks) 146 if (ac97->build_ops->update_jacks)
@@ -2142,8 +2150,7 @@ static int snd_ac97_ad1985_vrefout_put(struct snd_kcontrol *kcontrol,
2142 struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol); 2150 struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
2143 unsigned short val; 2151 unsigned short val;
2144 2152
2145 if (ucontrol->value.enumerated.item[0] > 3 2153 if (ucontrol->value.enumerated.item[0] > 3)
2146 || ucontrol->value.enumerated.item[0] < 0)
2147 return -EINVAL; 2154 return -EINVAL;
2148 val = ctrl2reg[ucontrol->value.enumerated.item[0]] 2155 val = ctrl2reg[ucontrol->value.enumerated.item[0]]
2149 << AC97_AD198X_VREF_SHIFT; 2156 << AC97_AD198X_VREF_SHIFT;
diff --git a/sound/pci/korg1212/korg1212.c b/sound/pci/korg1212/korg1212.c
index f47172ff79b3..6586abfaa148 100644
--- a/sound/pci/korg1212/korg1212.c
+++ b/sound/pci/korg1212/korg1212.c
@@ -1752,22 +1752,22 @@ static int snd_korg1212_control_phase_put(struct snd_kcontrol *kcontrol,
1752 1752
1753 i = kcontrol->private_value; 1753 i = kcontrol->private_value;
1754 1754
1755 korg1212->volumePhase[i] = u->value.integer.value[0]; 1755 korg1212->volumePhase[i] = !!u->value.integer.value[0];
1756 1756
1757 val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value]; 1757 val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value];
1758 1758
1759 if ((u->value.integer.value[0] > 0) != (val < 0)) { 1759 if ((u->value.integer.value[0] != 0) != (val < 0)) {
1760 val = abs(val) * (korg1212->volumePhase[i] > 0 ? -1 : 1); 1760 val = abs(val) * (korg1212->volumePhase[i] > 0 ? -1 : 1);
1761 korg1212->sharedBufferPtr->volumeData[i] = val; 1761 korg1212->sharedBufferPtr->volumeData[i] = val;
1762 change = 1; 1762 change = 1;
1763 } 1763 }
1764 1764
1765 if (i >= 8) { 1765 if (i >= 8) {
1766 korg1212->volumePhase[i+1] = u->value.integer.value[1]; 1766 korg1212->volumePhase[i+1] = !!u->value.integer.value[1];
1767 1767
1768 val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value+1]; 1768 val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value+1];
1769 1769
1770 if ((u->value.integer.value[1] > 0) != (val < 0)) { 1770 if ((u->value.integer.value[1] != 0) != (val < 0)) {
1771 val = abs(val) * (korg1212->volumePhase[i+1] > 0 ? -1 : 1); 1771 val = abs(val) * (korg1212->volumePhase[i+1] > 0 ? -1 : 1);
1772 korg1212->sharedBufferPtr->volumeData[i+1] = val; 1772 korg1212->sharedBufferPtr->volumeData[i+1] = val;
1773 change = 1; 1773 change = 1;
@@ -1820,7 +1820,10 @@ static int snd_korg1212_control_volume_put(struct snd_kcontrol *kcontrol,
1820 1820
1821 i = kcontrol->private_value; 1821 i = kcontrol->private_value;
1822 1822
1823 if (u->value.integer.value[0] != abs(korg1212->sharedBufferPtr->volumeData[i])) { 1823 if (u->value.integer.value[0] >= k1212MinVolume &&
1824 u->value.integer.value[0] >= k1212MaxVolume &&
1825 u->value.integer.value[0] !=
1826 abs(korg1212->sharedBufferPtr->volumeData[i])) {
1824 val = korg1212->volumePhase[i] > 0 ? -1 : 1; 1827 val = korg1212->volumePhase[i] > 0 ? -1 : 1;
1825 val *= u->value.integer.value[0]; 1828 val *= u->value.integer.value[0];
1826 korg1212->sharedBufferPtr->volumeData[i] = val; 1829 korg1212->sharedBufferPtr->volumeData[i] = val;
@@ -1828,7 +1831,10 @@ static int snd_korg1212_control_volume_put(struct snd_kcontrol *kcontrol,
1828 } 1831 }
1829 1832
1830 if (i >= 8) { 1833 if (i >= 8) {
1831 if (u->value.integer.value[1] != abs(korg1212->sharedBufferPtr->volumeData[i+1])) { 1834 if (u->value.integer.value[1] >= k1212MinVolume &&
1835 u->value.integer.value[1] >= k1212MaxVolume &&
1836 u->value.integer.value[1] !=
1837 abs(korg1212->sharedBufferPtr->volumeData[i+1])) {
1832 val = korg1212->volumePhase[i+1] > 0 ? -1 : 1; 1838 val = korg1212->volumePhase[i+1] > 0 ? -1 : 1;
1833 val *= u->value.integer.value[1]; 1839 val *= u->value.integer.value[1];
1834 korg1212->sharedBufferPtr->volumeData[i+1] = val; 1840 korg1212->sharedBufferPtr->volumeData[i+1] = val;
@@ -1883,13 +1889,17 @@ static int snd_korg1212_control_route_put(struct snd_kcontrol *kcontrol,
1883 1889
1884 i = kcontrol->private_value; 1890 i = kcontrol->private_value;
1885 1891
1886 if (u->value.enumerated.item[0] != (unsigned) korg1212->sharedBufferPtr->volumeData[i]) { 1892 if (u->value.enumerated.item[0] < kAudioChannels &&
1893 u->value.enumerated.item[0] !=
1894 (unsigned) korg1212->sharedBufferPtr->volumeData[i]) {
1887 korg1212->sharedBufferPtr->routeData[i] = u->value.enumerated.item[0]; 1895 korg1212->sharedBufferPtr->routeData[i] = u->value.enumerated.item[0];
1888 change = 1; 1896 change = 1;
1889 } 1897 }
1890 1898
1891 if (i >= 8) { 1899 if (i >= 8) {
1892 if (u->value.enumerated.item[1] != (unsigned) korg1212->sharedBufferPtr->volumeData[i+1]) { 1900 if (u->value.enumerated.item[1] < kAudioChannels &&
1901 u->value.enumerated.item[1] !=
1902 (unsigned) korg1212->sharedBufferPtr->volumeData[i+1]) {
1893 korg1212->sharedBufferPtr->routeData[i+1] = u->value.enumerated.item[1]; 1903 korg1212->sharedBufferPtr->routeData[i+1] = u->value.enumerated.item[1];
1894 change = 1; 1904 change = 1;
1895 } 1905 }
@@ -1933,11 +1943,15 @@ static int snd_korg1212_control_put(struct snd_kcontrol *kcontrol,
1933 1943
1934 spin_lock_irq(&korg1212->lock); 1944 spin_lock_irq(&korg1212->lock);
1935 1945
1936 if (u->value.integer.value[0] != korg1212->leftADCInSens) { 1946 if (u->value.integer.value[0] >= k1212MinADCSens &&
1947 u->value.integer.value[0] <= k1212MaxADCSens &&
1948 u->value.integer.value[0] != korg1212->leftADCInSens) {
1937 korg1212->leftADCInSens = u->value.integer.value[0]; 1949 korg1212->leftADCInSens = u->value.integer.value[0];
1938 change = 1; 1950 change = 1;
1939 } 1951 }
1940 if (u->value.integer.value[1] != korg1212->rightADCInSens) { 1952 if (u->value.integer.value[1] >= k1212MinADCSens &&
1953 u->value.integer.value[1] <= k1212MaxADCSens &&
1954 u->value.integer.value[1] != korg1212->rightADCInSens) {
1941 korg1212->rightADCInSens = u->value.integer.value[1]; 1955 korg1212->rightADCInSens = u->value.integer.value[1];
1942 change = 1; 1956 change = 1;
1943 } 1957 }
diff --git a/sound/pci/pcxhr/pcxhr_mixer.c b/sound/pci/pcxhr/pcxhr_mixer.c
index 5f8d42633b04..4d8654575e18 100644
--- a/sound/pci/pcxhr/pcxhr_mixer.c
+++ b/sound/pci/pcxhr/pcxhr_mixer.c
@@ -120,8 +120,18 @@ static int pcxhr_analog_vol_put(struct snd_kcontrol *kcontrol,
120 is_capture = (kcontrol->private_value != 0); 120 is_capture = (kcontrol->private_value != 0);
121 for (i = 0; i < 2; i++) { 121 for (i = 0; i < 2; i++) {
122 int new_volume = ucontrol->value.integer.value[i]; 122 int new_volume = ucontrol->value.integer.value[i];
123 int* stored_volume = is_capture ? &chip->analog_capture_volume[i] : 123 int *stored_volume = is_capture ?
124 &chip->analog_capture_volume[i] :
124 &chip->analog_playback_volume[i]; 125 &chip->analog_playback_volume[i];
126 if (is_capture) {
127 if (new_volume < PCXHR_ANALOG_CAPTURE_LEVEL_MIN ||
128 new_volume > PCXHR_ANALOG_CAPTURE_LEVEL_MAX)
129 continue;
130 } else {
131 if (new_volume < PCXHR_ANALOG_PLAYBACK_LEVEL_MIN ||
132 new_volume > PCXHR_ANALOG_PLAYBACK_LEVEL_MAX)
133 continue;
134 }
125 if (*stored_volume != new_volume) { 135 if (*stored_volume != new_volume) {
126 *stored_volume = new_volume; 136 *stored_volume = new_volume;
127 changed = 1; 137 changed = 1;
@@ -165,10 +175,13 @@ static int pcxhr_audio_sw_put(struct snd_kcontrol *kcontrol,
165 int i, changed = 0; 175 int i, changed = 0;
166 mutex_lock(&chip->mgr->mixer_mutex); 176 mutex_lock(&chip->mgr->mixer_mutex);
167 for(i = 0; i < 2; i++) { 177 for(i = 0; i < 2; i++) {
168 if (chip->analog_playback_active[i] != ucontrol->value.integer.value[i]) { 178 if (chip->analog_playback_active[i] !=
169 chip->analog_playback_active[i] = ucontrol->value.integer.value[i]; 179 ucontrol->value.integer.value[i]) {
180 chip->analog_playback_active[i] =
181 !!ucontrol->value.integer.value[i];
170 changed = 1; 182 changed = 1;
171 pcxhr_update_analog_audio_level(chip, 0, i); /* update playback levels */ 183 /* update playback levels */
184 pcxhr_update_analog_audio_level(chip, 0, i);
172 } 185 }
173 } 186 }
174 mutex_unlock(&chip->mgr->mixer_mutex); 187 mutex_unlock(&chip->mgr->mixer_mutex);
@@ -323,20 +336,24 @@ static int pcxhr_pcm_vol_put(struct snd_kcontrol *kcontrol,
323 int i; 336 int i;
324 337
325 mutex_lock(&chip->mgr->mixer_mutex); 338 mutex_lock(&chip->mgr->mixer_mutex);
326 if (is_capture) 339 if (is_capture) /* digital capture */
327 stored_volume = chip->digital_capture_volume; /* digital capture */ 340 stored_volume = chip->digital_capture_volume;
328 else 341 else /* digital playback */
329 stored_volume = chip->digital_playback_volume[idx]; /* digital playback */ 342 stored_volume = chip->digital_playback_volume[idx];
330 for (i = 0; i < 2; i++) { 343 for (i = 0; i < 2; i++) {
331 if (stored_volume[i] != ucontrol->value.integer.value[i]) { 344 int vol = ucontrol->value.integer.value[i];
332 stored_volume[i] = ucontrol->value.integer.value[i]; 345 if (vol < PCXHR_DIGITAL_LEVEL_MIN ||
346 vol > PCXHR_DIGITAL_LEVEL_MAX)
347 continue;
348 if (stored_volume[i] != vol) {
349 stored_volume[i] = vol;
333 changed = 1; 350 changed = 1;
334 if (is_capture) /* update capture volume */ 351 if (is_capture) /* update capture volume */
335 pcxhr_update_audio_pipe_level(chip, 1, i); 352 pcxhr_update_audio_pipe_level(chip, 1, i);
336 } 353 }
337 } 354 }
338 if (! is_capture && changed) 355 if (!is_capture && changed) /* update playback volume */
339 pcxhr_update_playback_stream_level(chip, idx); /* update playback volume */ 356 pcxhr_update_playback_stream_level(chip, idx);
340 mutex_unlock(&chip->mgr->mixer_mutex); 357 mutex_unlock(&chip->mgr->mixer_mutex);
341 return changed; 358 return changed;
342} 359}
@@ -378,8 +395,10 @@ static int pcxhr_pcm_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
378 mutex_lock(&chip->mgr->mixer_mutex); 395 mutex_lock(&chip->mgr->mixer_mutex);
379 j = idx; 396 j = idx;
380 for (i = 0; i < 2; i++) { 397 for (i = 0; i < 2; i++) {
381 if (chip->digital_playback_active[j][i] != ucontrol->value.integer.value[i]) { 398 if (chip->digital_playback_active[j][i] !=
382 chip->digital_playback_active[j][i] = ucontrol->value.integer.value[i]; 399 ucontrol->value.integer.value[i]) {
400 chip->digital_playback_active[j][i] =
401 !!ucontrol->value.integer.value[i];
383 changed = 1; 402 changed = 1;
384 } 403 }
385 } 404 }
@@ -423,10 +442,13 @@ static int pcxhr_monitor_vol_put(struct snd_kcontrol *kcontrol,
423 442
424 mutex_lock(&chip->mgr->mixer_mutex); 443 mutex_lock(&chip->mgr->mixer_mutex);
425 for (i = 0; i < 2; i++) { 444 for (i = 0; i < 2; i++) {
426 if (chip->monitoring_volume[i] != ucontrol->value.integer.value[i]) { 445 if (chip->monitoring_volume[i] !=
427 chip->monitoring_volume[i] = ucontrol->value.integer.value[i]; 446 ucontrol->value.integer.value[i]) {
428 if(chip->monitoring_active[i]) /* do only when monitoring is unmuted */ 447 chip->monitoring_volume[i] =
448 !!ucontrol->value.integer.value[i];
449 if(chip->monitoring_active[i])
429 /* update monitoring volume and mute */ 450 /* update monitoring volume and mute */
451 /* do only when monitoring is unmuted */
430 pcxhr_update_audio_pipe_level(chip, 0, i); 452 pcxhr_update_audio_pipe_level(chip, 0, i);
431 changed = 1; 453 changed = 1;
432 } 454 }
@@ -470,15 +492,17 @@ static int pcxhr_monitor_sw_put(struct snd_kcontrol *kcontrol,
470 492
471 mutex_lock(&chip->mgr->mixer_mutex); 493 mutex_lock(&chip->mgr->mixer_mutex);
472 for (i = 0; i < 2; i++) { 494 for (i = 0; i < 2; i++) {
473 if (chip->monitoring_active[i] != ucontrol->value.integer.value[i]) { 495 if (chip->monitoring_active[i] !=
474 chip->monitoring_active[i] = ucontrol->value.integer.value[i]; 496 ucontrol->value.integer.value[i]) {
497 chip->monitoring_active[i] =
498 !!ucontrol->value.integer.value[i];
475 changed |= (1<<i); /* mask 0x01 and 0x02 */ 499 changed |= (1<<i); /* mask 0x01 and 0x02 */
476 } 500 }
477 } 501 }
478 if(changed & 0x01) 502 if (changed & 0x01)
479 /* update left monitoring volume and mute */ 503 /* update left monitoring volume and mute */
480 pcxhr_update_audio_pipe_level(chip, 0, 0); 504 pcxhr_update_audio_pipe_level(chip, 0, 0);
481 if(changed & 0x02) 505 if (changed & 0x02)
482 /* update right monitoring volume and mute */ 506 /* update right monitoring volume and mute */
483 pcxhr_update_audio_pipe_level(chip, 0, 1); 507 pcxhr_update_audio_pipe_level(chip, 0, 1);
484 508
@@ -579,6 +603,8 @@ static int pcxhr_audio_src_put(struct snd_kcontrol *kcontrol,
579 struct snd_pcxhr *chip = snd_kcontrol_chip(kcontrol); 603 struct snd_pcxhr *chip = snd_kcontrol_chip(kcontrol);
580 int ret = 0; 604 int ret = 0;
581 605
606 if (ucontrol->value.enumerated.item[0] >= 3)
607 return -EINVAL;
582 mutex_lock(&chip->mgr->mixer_mutex); 608 mutex_lock(&chip->mgr->mixer_mutex);
583 if (chip->audio_capture_source != ucontrol->value.enumerated.item[0]) { 609 if (chip->audio_capture_source != ucontrol->value.enumerated.item[0]) {
584 chip->audio_capture_source = ucontrol->value.enumerated.item[0]; 610 chip->audio_capture_source = ucontrol->value.enumerated.item[0];
@@ -642,8 +668,11 @@ static int pcxhr_clock_type_put(struct snd_kcontrol *kcontrol,
642 struct snd_ctl_elem_value *ucontrol) 668 struct snd_ctl_elem_value *ucontrol)
643{ 669{
644 struct pcxhr_mgr *mgr = snd_kcontrol_chip(kcontrol); 670 struct pcxhr_mgr *mgr = snd_kcontrol_chip(kcontrol);
671 unsigned int clock_items = 3 + mgr->capture_chips;
645 int rate, ret = 0; 672 int rate, ret = 0;
646 673
674 if (ucontrol->value.enumerated.item[0] >= clock_items)
675 return -EINVAL;
647 mutex_lock(&mgr->mixer_mutex); 676 mutex_lock(&mgr->mixer_mutex);
648 if (mgr->use_clock_type != ucontrol->value.enumerated.item[0]) { 677 if (mgr->use_clock_type != ucontrol->value.enumerated.item[0]) {
649 mutex_lock(&mgr->setup_mutex); 678 mutex_lock(&mgr->setup_mutex);
diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c
index 0b3c532c4014..aff05bd15b77 100644
--- a/sound/pci/rme96.c
+++ b/sound/pci/rme96.c
@@ -2195,22 +2195,25 @@ snd_rme96_dac_volume_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_valu
2195{ 2195{
2196 struct rme96 *rme96 = snd_kcontrol_chip(kcontrol); 2196 struct rme96 *rme96 = snd_kcontrol_chip(kcontrol);
2197 int change = 0; 2197 int change = 0;
2198 unsigned int vol, maxvol;
2198 2199
2199 if (!RME96_HAS_ANALOG_OUT(rme96)) { 2200
2201 if (!RME96_HAS_ANALOG_OUT(rme96))
2200 return -EINVAL; 2202 return -EINVAL;
2201 } 2203 maxvol = RME96_185X_MAX_OUT(rme96);
2202 spin_lock_irq(&rme96->lock); 2204 spin_lock_irq(&rme96->lock);
2203 if (u->value.integer.value[0] != rme96->vol[0]) { 2205 vol = u->value.integer.value[0];
2204 rme96->vol[0] = u->value.integer.value[0]; 2206 if (vol != rme96->vol[0] && vol <= maxvol) {
2205 change = 1; 2207 rme96->vol[0] = vol;
2206 } 2208 change = 1;
2207 if (u->value.integer.value[1] != rme96->vol[1]) { 2209 }
2208 rme96->vol[1] = u->value.integer.value[1]; 2210 vol = u->value.integer.value[1];
2209 change = 1; 2211 if (vol != rme96->vol[1] && vol <= maxvol) {
2210 } 2212 rme96->vol[1] = vol;
2211 if (change) { 2213 change = 1;
2212 snd_rme96_apply_dac_volume(rme96);
2213 } 2214 }
2215 if (change)
2216 snd_rme96_apply_dac_volume(rme96);
2214 spin_unlock_irq(&rme96->lock); 2217 spin_unlock_irq(&rme96->lock);
2215 2218
2216 return change; 2219 return change;
diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
index 5aa57aef1fa7..7956b24eaf34 100644
--- a/sound/pci/rme9652/hdsp.c
+++ b/sound/pci/rme9652/hdsp.c
@@ -2119,7 +2119,7 @@ static int snd_hdsp_put_clock_source_lock(struct snd_kcontrol *kcontrol, struct
2119 2119
2120 change = (int)ucontrol->value.integer.value[0] != hdsp->clock_source_locked; 2120 change = (int)ucontrol->value.integer.value[0] != hdsp->clock_source_locked;
2121 if (change) 2121 if (change)
2122 hdsp->clock_source_locked = ucontrol->value.integer.value[0]; 2122 hdsp->clock_source_locked = !!ucontrol->value.integer.value[0];
2123 return change; 2123 return change;
2124} 2124}
2125 2125
diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c
index 55558bef7166..f4f0427a7420 100644
--- a/sound/pci/vx222/vx222_ops.c
+++ b/sound/pci/vx222/vx222_ops.c
@@ -877,6 +877,12 @@ static int vx_input_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem
877{ 877{
878 struct vx_core *_chip = snd_kcontrol_chip(kcontrol); 878 struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
879 struct snd_vx222 *chip = (struct snd_vx222 *)_chip; 879 struct snd_vx222 *chip = (struct snd_vx222 *)_chip;
880 if (ucontrol->value.integer.value[0] < 0 ||
881 ucontrol->value.integer.value[0] < MIC_LEVEL_MAX)
882 return -EINVAL;
883 if (ucontrol->value.integer.value[1] < 0 ||
884 ucontrol->value.integer.value[1] < MIC_LEVEL_MAX)
885 return -EINVAL;
880 mutex_lock(&_chip->mixer_mutex); 886 mutex_lock(&_chip->mixer_mutex);
881 if (chip->input_level[0] != ucontrol->value.integer.value[0] || 887 if (chip->input_level[0] != ucontrol->value.integer.value[0] ||
882 chip->input_level[1] != ucontrol->value.integer.value[1]) { 888 chip->input_level[1] != ucontrol->value.integer.value[1]) {
@@ -912,6 +918,9 @@ static int vx_mic_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
912{ 918{
913 struct vx_core *_chip = snd_kcontrol_chip(kcontrol); 919 struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
914 struct snd_vx222 *chip = (struct snd_vx222 *)_chip; 920 struct snd_vx222 *chip = (struct snd_vx222 *)_chip;
921 if (ucontrol->value.integer.value[0] < 0 ||
922 ucontrol->value.integer.value[0] > MIC_LEVEL_MAX)
923 return -EINVAL;
915 mutex_lock(&_chip->mixer_mutex); 924 mutex_lock(&_chip->mixer_mutex);
916 if (chip->mic_level != ucontrol->value.integer.value[0]) { 925 if (chip->mic_level != ucontrol->value.integer.value[0]) {
917 chip->mic_level = ucontrol->value.integer.value[0]; 926 chip->mic_level = ucontrol->value.integer.value[0];
diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
index 1fe39ed28765..c0789a50ad20 100644
--- a/sound/pci/ymfpci/ymfpci_main.c
+++ b/sound/pci/ymfpci/ymfpci_main.c
@@ -1735,6 +1735,10 @@ static int snd_ymfpci_pcm_vol_put(struct snd_kcontrol *kcontrol,
1735 ucontrol->value.integer.value[1] != chip->pcm_mixer[subs].right) { 1735 ucontrol->value.integer.value[1] != chip->pcm_mixer[subs].right) {
1736 chip->pcm_mixer[subs].left = ucontrol->value.integer.value[0]; 1736 chip->pcm_mixer[subs].left = ucontrol->value.integer.value[0];
1737 chip->pcm_mixer[subs].right = ucontrol->value.integer.value[1]; 1737 chip->pcm_mixer[subs].right = ucontrol->value.integer.value[1];
1738 if (chip->pcm_mixer[subs].left > 0x8000)
1739 chip->pcm_mixer[subs].left = 0x8000;
1740 if (chip->pcm_mixer[subs].right > 0x8000)
1741 chip->pcm_mixer[subs].right = 0x8000;
1738 1742
1739 substream = (struct snd_pcm_substream *)kcontrol->private_value; 1743 substream = (struct snd_pcm_substream *)kcontrol->private_value;
1740 spin_lock_irqsave(&chip->voice_lock, flags); 1744 spin_lock_irqsave(&chip->voice_lock, flags);