tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]

component_dais[RSND_MAX_COMPONENT] is initially zero-initialized
and later populated in rsnd_dai_of_node(). However, the existing boundary check:
if (i >= RSND_MAX_COMPONENT)

does not guarantee that the last valid element remains zero. As a result,
the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero,
which may lead to an out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 547b02f74e4a ("ASoC: rsnd: enable multi Component support for Audio Graph Card/Card2")
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/20260327103311.459239-1-gerben@altlinux.org
Signed-off-by: Mark Brown <broonie@kernel.org>

authored by

Denis Rastyogin and committed by
Mark Brown f9e437cd 0178e641

+1 -1
+1 -1
sound/soc/renesas/rcar/core.c
··· 1974 1974 * asoc register 1975 1975 */ 1976 1976 ci = 0; 1977 - for (i = 0; priv->component_dais[i] > 0; i++) { 1977 + for (i = 0; i < RSND_MAX_COMPONENT && priv->component_dais[i] > 0; i++) { 1978 1978 int nr = priv->component_dais[i]; 1979 1979 1980 1980 ret = devm_snd_soc_register_component(dev, &rsnd_soc_component,