From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Ravulapati Vishnu Vardhan Rao <quic_visr@quicinc.com>,
Sasha Levin <sashal@kernel.org>,
srinivas.kandagatla@linaro.org, bgoswami@quicinc.com,
lgirdwood@gmail.com, broonie@kernel.org, perex@perex.cz,
tiwai@suse.com, alsa-devel@alsa-project.org
Subject: [PATCH AUTOSEL 5.15 11/24] ASoC: lpass: Fix for KASAN use_after_free out of bounds
Date: Wed, 31 May 2023 09:43:07 -0400 [thread overview]
Message-ID: <20230531134320.3384102-11-sashal@kernel.org> (raw)
In-Reply-To: <20230531134320.3384102-1-sashal@kernel.org>
From: Ravulapati Vishnu Vardhan Rao <quic_visr@quicinc.com>
[ Upstream commit 75e5fab7db0cecb6e16b22c34608f0b40a4c7cd1 ]
When we run syzkaller we get below Out of Bounds error.
"KASAN: slab-out-of-bounds Read in regcache_flat_read"
Below is the backtrace of the issue:
BUG: KASAN: slab-out-of-bounds in regcache_flat_read+0x10c/0x110
Read of size 4 at addr ffffff8088fbf714 by task syz-executor.4/14144
CPU: 6 PID: 14144 Comm: syz-executor.4 Tainted: G W
Hardware name: Qualcomm Technologies, Inc. sc7280 CRD platform (rev5+) (DT)
Call trace:
dump_backtrace+0x0/0x4ec
show_stack+0x34/0x50
dump_stack_lvl+0xdc/0x11c
print_address_description+0x30/0x2d8
kasan_report+0x178/0x1e4
__asan_report_load4_noabort+0x44/0x50
regcache_flat_read+0x10c/0x110
regcache_read+0xf8/0x5a0
_regmap_read+0x45c/0x86c
_regmap_update_bits+0x128/0x290
regmap_update_bits_base+0xc0/0x15c
snd_soc_component_update_bits+0xa8/0x22c
snd_soc_component_write_field+0x68/0xd4
tx_macro_put_dec_enum+0x1d0/0x268
snd_ctl_elem_write+0x288/0x474
By Error checking and checking valid values issue gets rectifies.
Signed-off-by: Ravulapati Vishnu Vardhan Rao <quic_visr@quicinc.com
Link: https://lore.kernel.org/r/20230511112532.16106-1-quic_visr@quicinc.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-tx-macro.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
index 35d148e60c334..4377e91733b87 100644
--- a/sound/soc/codecs/lpass-tx-macro.c
+++ b/sound/soc/codecs/lpass-tx-macro.c
@@ -743,6 +743,8 @@ static int tx_macro_put_dec_enum(struct snd_kcontrol *kcontrol,
struct tx_macro *tx = snd_soc_component_get_drvdata(component);
val = ucontrol->value.enumerated.item[0];
+ if (val >= e->items)
+ return -EINVAL;
switch (e->reg) {
case CDC_TX_INP_MUX_ADC_MUX0_CFG0:
@@ -769,6 +771,9 @@ static int tx_macro_put_dec_enum(struct snd_kcontrol *kcontrol,
case CDC_TX_INP_MUX_ADC_MUX7_CFG0:
mic_sel_reg = CDC_TX7_TX_PATH_CFG0;
break;
+ default:
+ dev_err(component->dev, "Error in configuration!!\n");
+ return -EINVAL;
}
if (val != 0) {
--
2.39.2
next prev parent reply other threads:[~2023-05-31 14:01 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-31 13:42 [PATCH AUTOSEL 5.15 01/24] power: supply: ab8500: Fix external_power_changed race Sasha Levin
2023-05-31 13:42 ` [PATCH AUTOSEL 5.15 02/24] power: supply: sc27xx: " Sasha Levin
2023-05-31 13:42 ` [PATCH AUTOSEL 5.15 03/24] power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 04/24] ARM: dts: vexpress: add missing cache properties Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 05/24] tools: gpio: fix debounce_period_us output of lsgpio Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 06/24] power: supply: Ratelimit no data debug output Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 07/24] platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 08/24] regulator: Fix error checking for debugfs_create_dir Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 09/24] irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 10/24] power: supply: Fix logic checking if system is running from battery Sasha Levin
2023-05-31 13:43 ` Sasha Levin [this message]
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 12/24] btrfs: scrub: try harder to mark RAID56 block groups read-only Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 13/24] btrfs: handle memory allocation failure in btrfs_csum_one_bio Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 14/24] ASoC: soc-pcm: test if a BE can be prepared Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 15/24] parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu() Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 16/24] parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory() Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 17/24] MIPS: unhide PATA_PLATFORM Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 18/24] MIPS: Restore Au1300 support Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 19/24] MIPS: Alchemy: fix dbdma2 Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 20/24] mips: Move initrd_start check after initrd address sanitisation Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 21/24] ASoC: dwc: move DMA init to snd_soc_dai_driver probe() Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 22/24] xen/blkfront: Only check REQ_FUA for writes Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 23/24] drm:amd:amdgpu: Fix missing buffer object unlock in failure path Sasha Levin
2023-05-31 13:43 ` [PATCH AUTOSEL 5.15 24/24] NVMe: Add MAXIO 1602 to bogus nid list Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230531134320.3384102-11-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=alsa-devel@alsa-project.org \
--cc=bgoswami@quicinc.com \
--cc=broonie@kernel.org \
--cc=lgirdwood@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=perex@perex.cz \
--cc=quic_visr@quicinc.com \
--cc=srinivas.kandagatla@linaro.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).