Subject: CVE-2022-48917: ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min

While the $val/$val2 values passed in from userspace are always >= 0
integers, the limits of the control can be signed integers and the $min
can be non-zero and less than zero. To correctly validate $val/$val2
against platform_max, add the $min offset to val first.

The Linux kernel CVE team has assigned CVE-2022-48917 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 4.9.300 with commit 40f598698129 and fixed in 4.9.305 with commit 69f42e41256d
	Issue introduced in 4.14.265 with commit 586ef863c943 and fixed in 4.14.270 with commit 7e0e4bc93811
	Issue introduced in 4.19.228 with commit 65a61b1f56f5 and fixed in 4.19.233 with commit 0b2ecc916347
	Issue introduced in 5.4.178 with commit 68fd71872428 and fixed in 5.4.183 with commit f3537f1b2bfd
	Issue introduced in 5.10.99 with commit a9394f21fba0 and fixed in 5.10.104 with commit 6951a5888165
	Issue introduced in 5.15.22 with commit 9e8895f1b3d4 and fixed in 5.15.27 with commit 050b1821f27c
	Issue introduced in 5.16.8 with commit bb72d2dda855 and fixed in 5.16.13 with commit 70712d5afbbe

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-48917
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	sound/soc/soc-ops.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/69f42e41256d5a234d3ae0d35fa66dc6d8171846
	https://git.kernel.org/stable/c/7e0e4bc93811cf600508ff36f07abea7b40643ed
	https://git.kernel.org/stable/c/0b2ecc9163472128e7f30b517bee92dcd27ffc34
	https://git.kernel.org/stable/c/f3537f1b2bfd3b1df15723df49fc26eccd5112fe
	https://git.kernel.org/stable/c/6951a5888165a38bb7c39a2d18f5668b2f1241c7
	https://git.kernel.org/stable/c/050b1821f27c5d4fd5a298f6e62c3d3c9335e622
	https://git.kernel.org/stable/c/70712d5afbbea898d5f51fa02e315fe0a4835043
	https://git.kernel.org/stable/c/9bdd10d57a8807dba0003af0325191f3cec0f11c