From e913917febd31998e3d0b9e8c861e538a6185045 Mon Sep 17 00:00:00 2001 From: Priyanka Mani Date: Mon, 12 Oct 2026 05:31:19 +0000 Subject: [PATCH] ASoC: mediatek: mt8365: Fix out-of-bounds read in get_iir_coef() get_iir_coef() looks up a resampling coefficient set by reading an index "k" from iir_coef_tbl_matrix[][] and using it to index iir_coef_tbl_list[], which has 8 entries (valid indices 0..7). Before the lookup, "k" is only rejected when it is >= IIR_NO_NEED (11), or equal to IIR_RATIOVER (9) or IIR_INV_COEF (10). The value 8 is neither a sentinel nor a valid table index, so it falls through to the else branch and iir_coef_tbl_list[8] is read one element past the end of the array. The bogus coef pointer and count are then returned to mt8365_dai_set_config(), which dereferences coef. The current matrix never produces 8, so this cannot be triggered today, but the bounds check is wrong: it relies on the matrix contents instead of the size of the array it guards. Bound the lookup with the actual array size so only valid indices reach the table. This was found by Smatch: sound/soc/mediatek/mt8365/mt8365-dai-i2s.c:271 get_iir_coef() error: buffer overflow 'iir_coef_tbl_list' 8 <= 8 Fixes: 402bbb13a195 ("ASoC: mediatek: mt8365: Add I2S DAI support") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/67af3580-a907-403d-8bfd-76b5c304ab99@stanley.mountain/ Signed-off-by: Priyanka Mani Link: https://patch.msgid.link/403cc04bb103dff096edf72b99ae6868ee91f359.1791782072.git.priyankamani2100@gmail.com Signed-off-by: Mark Brown --- sound/soc/mediatek/mt8365/mt8365-dai-i2s.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/mediatek/mt8365/mt8365-dai-i2s.c b/sound/soc/mediatek/mt8365/mt8365-dai-i2s.c index a058973662b3..2e678f4aa4b1 100644 --- a/sound/soc/mediatek/mt8365/mt8365-dai-i2s.c +++ b/sound/soc/mediatek/mt8365/mt8365-dai-i2s.c @@ -267,7 +267,7 @@ static const u32 *get_iir_coef(unsigned int input_fs, if (k >= IIR_NO_NEED) { } else if (k == IIR_RATIOVER) { } else if (k == IIR_INV_COEF) { - } else { + } else if (k < ARRAY_SIZE(iir_coef_tbl_list)) { coef = iir_coef_tbl_list[k].coef; cnt = iir_coef_tbl_list[k].cnt; }