diff options
| author | HyeongJun An <sammiee5311@gmail.com> | 2026-06-09 15:43:16 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2026-06-11 22:44:45 +0300 |
| commit | 1d8aabb413b5638670dfd1162169edc0ba276a2e (patch) | |
| tree | d6c9b15678615fcaea798e9986c81a1ebf96073a | |
| parent | 3cd17e4e2871114d5579fa7bc8da66faf7fc1930 (diff) | |
| download | linux-1d8aabb413b5638670dfd1162169edc0ba276a2e.tar.xz | |
ASoC: tegra: tegra210_ahub: Validate written enum value
tegra_ahub_put_value_enum() reads e->values[item[0]] before
checking whether item[0] is within the enum item range. The existing
check therefore happens too late to prevent an out-of-range read of the
values array.
Move the check before the array access.
Fixes: 16e1bcc2caf4 ("ASoC: tegra: Add Tegra210 based AHUB driver")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260609124317.38046-5-sammiee5311@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
| -rw-r--r-- | sound/soc/tegra/tegra210_ahub.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c index ece33b7ff190..efc8f3388668 100644 --- a/sound/soc/tegra/tegra210_ahub.c +++ b/sound/soc/tegra/tegra210_ahub.c @@ -62,13 +62,15 @@ static int tegra_ahub_put_value_enum(struct snd_kcontrol *kctl, struct snd_soc_dapm_update update[TEGRA_XBAR_UPDATE_MAX_REG] = { }; int val_bytes = snd_soc_component_regmap_val_bytes(cmpnt); unsigned int *item = uctl->value.enumerated.item; - unsigned int value = e->values[item[0]]; + unsigned int value; unsigned int i, bit_pos, reg_idx = 0, reg_val = 0; int change = 0; if (item[0] >= e->items) return -EINVAL; + value = e->values[item[0]]; + if (value) { /* Get the register index and value to set */ reg_idx = (value - 1) / (8 * val_bytes); |