diff options
| author | Denis Rastyogin <gerben@altlinux.org> | 2026-03-27 13:33:11 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2026-04-03 13:37:20 +0100 |
| commit | f9e437cddf6cf9e603bdaefe148c1f4792aaf39c (patch) | |
| tree | 973c320f055499c5548255899fdcddd8437542d0 | |
| parent | 0178e64123129f56fc153b9d53121318fd71bdfc (diff) | |
| download | linux-f9e437cddf6cf9e603bdaefe148c1f4792aaf39c.tar.gz linux-f9e437cddf6cf9e603bdaefe148c1f4792aaf39c.zip | |
ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
component_dais[RSND_MAX_COMPONENT] is initially zero-initialized
and later populated in rsnd_dai_of_node(). However, the existing boundary check:
if (i >= RSND_MAX_COMPONENT)
does not guarantee that the last valid element remains zero. As a result,
the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero,
which may lead to an out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 547b02f74e4a ("ASoC: rsnd: enable multi Component support for Audio Graph Card/Card2")
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/20260327103311.459239-1-gerben@altlinux.org
Signed-off-by: Mark Brown <broonie@kernel.org>
| -rw-r--r-- | sound/soc/renesas/rcar/core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/soc/renesas/rcar/core.c b/sound/soc/renesas/rcar/core.c index 69fb19964a71..2dc078358612 100644 --- a/sound/soc/renesas/rcar/core.c +++ b/sound/soc/renesas/rcar/core.c @@ -1974,7 +1974,7 @@ static int rsnd_probe(struct platform_device *pdev) * asoc register */ ci = 0; - for (i = 0; priv->component_dais[i] > 0; i++) { + for (i = 0; i < RSND_MAX_COMPONENT && priv->component_dais[i] > 0; i++) { int nr = priv->component_dais[i]; ret = devm_snd_soc_register_component(dev, &rsnd_soc_component, |