diff options
| author | Cezary Rojewski <cezary.rojewski@intel.com> | 2025-05-30 16:10:23 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-19 15:32:20 +0200 |
| commit | 18ff538aac63de1866e5a49d57e22788b5c21d12 (patch) | |
| tree | 04a71e5f3a037a61af9b084b7733c63b2781183a | |
| parent | cabc3dc410e8c5a338052dab80d4824b53819d8b (diff) | |
ASoC: Intel: avs: Verify content returned by parse_int_array()
[ Upstream commit 93e246b6769bdacb09cfff4ea0f00fe5ab4f0d7a ]
The first element of the returned array stores its length. If it is 0,
any manipulation beyond the element at index 0 ends with null-ptr-deref.
Fixes: 5a565ba23abe ("ASoC: Intel: avs: Probing and firmware tracing over debugfs")
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20250530141025.2942936-8-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | sound/soc/intel/avs/debugfs.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sound/soc/intel/avs/debugfs.c b/sound/soc/intel/avs/debugfs.c index 1767ded4d983..c9978fb9c74e 100644 --- a/sound/soc/intel/avs/debugfs.c +++ b/sound/soc/intel/avs/debugfs.c @@ -372,7 +372,10 @@ static ssize_t trace_control_write(struct file *file, const char __user *from, s return ret; num_elems = *array; - resource_mask = array[1]; + if (!num_elems) { + ret = -EINVAL; + goto free_array; + } /* * Disable if just resource mask is provided - no log priority flags. @@ -380,6 +383,7 @@ static ssize_t trace_control_write(struct file *file, const char __user *from, s * Enable input format: mask, prio1, .., prioN * Where 'N' equals number of bits set in the 'mask'. */ + resource_mask = array[1]; if (num_elems == 1) { ret = disable_logs(adev, resource_mask); } else { |