All of lore.kernel.org
 help / color / mirror / Atom feed
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
To: broonie@kernel.org
Cc: perex@perex.cz, alsa-devel@alsa-project.org,
	linux-kernel@vger.kernel.org, lgirdwood@gmail.com,
	john.stultz@linaro.org, amit.pundir@linaro.org,
	bjorn.andersson@linaro.org,
	Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Subject: [PATCH v2 3/3] ASoC: codecs: wcd934x: add a sanity check in set channel map
Date: Tue,  9 Mar 2021 14:21:29 +0000	[thread overview]
Message-ID: <20210309142129.14182-4-srinivas.kandagatla@linaro.org> (raw)
In-Reply-To: <20210309142129.14182-1-srinivas.kandagatla@linaro.org>

set channel map can be passed with a channel maps, however if
the number of channels that are passed are more than the actual
supported channels then we would be accessing array out of bounds.

So add a sanity check to validate these numbers!

Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
Reported-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
---
Changes since v1:
	- make sure the wcd is not de-referenced without intialization

 sound/soc/codecs/wcd934x.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c
index 40f682f5dab8..d18ae5e3ee80 100644
--- a/sound/soc/codecs/wcd934x.c
+++ b/sound/soc/codecs/wcd934x.c
@@ -1873,6 +1873,12 @@ static int wcd934x_set_channel_map(struct snd_soc_dai *dai,
 
 	wcd = snd_soc_component_get_drvdata(dai->component);
 
+	if (tx_num > WCD934X_TX_MAX || rx_num > WCD934X_RX_MAX) {
+		dev_err(wcd->dev, "Invalid tx %d or rx %d channel count\n",
+			tx_num, rx_num);
+		return -EINVAL;
+	}
+
 	if (!tx_slot || !rx_slot) {
 		dev_err(wcd->dev, "Invalid tx_slot=%p, rx_slot=%p\n",
 			tx_slot, rx_slot);
-- 
2.21.0


WARNING: multiple messages have this Message-ID (diff)
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
To: broonie@kernel.org
Cc: amit.pundir@linaro.org, alsa-devel@alsa-project.org,
	bjorn.andersson@linaro.org, lgirdwood@gmail.com,
	linux-kernel@vger.kernel.org, john.stultz@linaro.org,
	Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Subject: [PATCH v2 3/3] ASoC: codecs: wcd934x: add a sanity check in set channel map
Date: Tue,  9 Mar 2021 14:21:29 +0000	[thread overview]
Message-ID: <20210309142129.14182-4-srinivas.kandagatla@linaro.org> (raw)
In-Reply-To: <20210309142129.14182-1-srinivas.kandagatla@linaro.org>

set channel map can be passed with a channel maps, however if
the number of channels that are passed are more than the actual
supported channels then we would be accessing array out of bounds.

So add a sanity check to validate these numbers!

Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
Reported-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
---
Changes since v1:
	- make sure the wcd is not de-referenced without intialization

 sound/soc/codecs/wcd934x.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c
index 40f682f5dab8..d18ae5e3ee80 100644
--- a/sound/soc/codecs/wcd934x.c
+++ b/sound/soc/codecs/wcd934x.c
@@ -1873,6 +1873,12 @@ static int wcd934x_set_channel_map(struct snd_soc_dai *dai,
 
 	wcd = snd_soc_component_get_drvdata(dai->component);
 
+	if (tx_num > WCD934X_TX_MAX || rx_num > WCD934X_RX_MAX) {
+		dev_err(wcd->dev, "Invalid tx %d or rx %d channel count\n",
+			tx_num, rx_num);
+		return -EINVAL;
+	}
+
 	if (!tx_slot || !rx_slot) {
 		dev_err(wcd->dev, "Invalid tx_slot=%p, rx_slot=%p\n",
 			tx_slot, rx_slot);
-- 
2.21.0


  parent reply	other threads:[~2021-03-09 14:23 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-09 14:21 [PATCH v2 0/3] ASoC: sdm845: array out of bound issues Srinivas Kandagatla
2021-03-09 14:21 ` Srinivas Kandagatla
2021-03-09 14:21 ` [PATCH v2 1/3] ASoC: qcom: sdm845: Fix array out of bounds access Srinivas Kandagatla
2021-03-09 14:21   ` Srinivas Kandagatla
2021-03-09 14:21 ` [PATCH v2 2/3] ASoC: qcom: sdm845: Fix array out of range on rx slim channels Srinivas Kandagatla
2021-03-09 14:21   ` Srinivas Kandagatla
2021-03-09 14:21 ` Srinivas Kandagatla [this message]
2021-03-09 14:21   ` [PATCH v2 3/3] ASoC: codecs: wcd934x: add a sanity check in set channel map Srinivas Kandagatla
2021-03-09 19:06 ` [PATCH v2 0/3] ASoC: sdm845: array out of bound issues Mark Brown
2021-03-09 19:06   ` Mark Brown
2021-03-09 19:08 ` John Stultz
2021-03-09 19:08   ` John Stultz
2021-03-11 13:00 [PATCH v2 3/3] ASoC: codecs: wcd934x: add a sanity check in set channel map Sufyan Sheikh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210309142129.14182-4-srinivas.kandagatla@linaro.org \
    --to=srinivas.kandagatla@linaro.org \
    --cc=alsa-devel@alsa-project.org \
    --cc=amit.pundir@linaro.org \
    --cc=bjorn.andersson@linaro.org \
    --cc=broonie@kernel.org \
    --cc=john.stultz@linaro.org \
    --cc=lgirdwood@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=perex@perex.cz \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.