Skip to content

Commit a62b3e6

Browse files
Gerben100gregkh
authored andcommitted
ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
[ Upstream commit f9e437c ] component_dais[RSND_MAX_COMPONENT] is initially zero-initialized and later populated in rsnd_dai_of_node(). However, the existing boundary check: if (i >= RSND_MAX_COMPONENT) does not guarantee that the last valid element remains zero. As a result, the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero, which may lead to an out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 547b02f ("ASoC: rsnd: enable multi Component support for Audio Graph Card/Card2") Signed-off-by: Denis Rastyogin <gerben@altlinux.org> Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/20260327103311.459239-1-gerben@altlinux.org Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
1 parent a05a94a commit a62b3e6

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

sound/soc/renesas/rcar/core.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1974,7 +1974,7 @@ static int rsnd_probe(struct platform_device *pdev)
19741974
* asoc register
19751975
*/
19761976
ci = 0;
1977-
for (i = 0; priv->component_dais[i] > 0; i++) {
1977+
for (i = 0; i < RSND_MAX_COMPONENT && priv->component_dais[i] > 0; i++) {
19781978
int nr = priv->component_dais[i];
19791979

19801980
ret = devm_snd_soc_register_component(dev, &rsnd_soc_component,

0 commit comments

Comments
 (0)