github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ASoC: mediatek: mt8365: Fix out-of-bounds read in get_iir_coef()

Browse Source 
get_iir_coef() looks up a resampling coefficient set by reading an
index "k" from iir_coef_tbl_matrix[][] and using it to index
iir_coef_tbl_list[], which has 8 entries (valid indices 0..7).

Before the lookup, "k" is only rejected when it is >= IIR_NO_NEED (11),
or equal to IIR_RATIOVER (9) or IIR_INV_COEF (10). The value 8 is
neither a sentinel nor a valid table index, so it falls through to the
else branch and iir_coef_tbl_list[8] is read one element past the end
of the array. The bogus coef pointer and count are then returned to
mt8365_dai_set_config(), which dereferences coef.

The current matrix never produces 8, so this cannot be triggered today,
but the bounds check is wrong: it relies on the matrix contents instead
of the size of the array it guards. Bound the lookup with the actual
array size so only valid indices reach the table.

This was found by Smatch:

  sound/soc/mediatek/mt8365/mt8365-dai-i2s.c:271 get_iir_coef()
  error: buffer overflow 'iir_coef_tbl_list' 8 <= 8

Fixes: 402bbb13a1 ("ASoC: mediatek: mt8365: Add I2S DAI support")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/67af3580-a907-403d-8bfd-76b5c304ab99@stanley.mountain/
Signed-off-by: Priyanka Mani <priyankamani2100@gmail.com>
Link: https://patch.msgid.link/403cc04bb103dff096edf72b99ae6868ee91f359.1791782072.git.priyankamani2100@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Priyanka Mani 2026-10-12 05:31:19 +00:00 committed by Mark Brown
parent ea83a1103b
commit e913917feb
No known key found for this signature in database
GPG Key ID: 2FEF73B0B3D03889
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sound/soc/mediatek/mt8365/mt8365-dai-i2s.c
View File

@ -267,7 +267,7 @@ static const u32 *get_iir_coef(unsigned int input_fs,
if (k >= IIR_NO_NEED) {
} else if (k == IIR_RATIOVER) {
} else if (k == IIR_INV_COEF) {
} else {
} else if (k < ARRAY_SIZE(iir_coef_tbl_list)) {
coef = iir_coef_tbl_list[k].coef;
cnt = iir_coef_tbl_list[k].cnt;
}