MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-23 07:23:12 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()

Browse Source 
[ Upstream commit 78338108b5a856dc98223a335f147846a8a18c51 ]

The sma1307->set.header_size is how many integers are in the header
(there are 8 of them) but instead of allocating space of 8 integers
we allocate 8 bytes.  This leads to memory corruption when we copy data
it on the next line:

        memcpy(sma1307->set.header, data,
               sma1307->set.header_size * sizeof(int));

Also since we're immediately copying over the memory in ->set.header,
there is no need to zero it in the allocator.  Use devm_kmalloc_array()
to allocate the memory instead.

Fixes: 576c57e6b4 ("ASoC: sma1307: Add driver for Iron Device SMA1307")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aLGjvjpueVstekXP@stanley.mountain
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dan Carpenter 2025-08-29 15:57:34 +03:00 committed by Greg Kroah-Hartman
parent 7c28b31b22
commit cd59ca8f75
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sound/soc/codecs/sma1307.c
View File

@ -1737,9 +1737,10 @@ static void sma1307_setting_loaded(struct sma1307_priv *sma1307, const char *fil
sma1307->set.checksum = data[sma1307->set.header_size - 2];
sma1307->set.num_mode = data[sma1307->set.header_size - 1];
num_mode = sma1307->set.num_mode;
sma1307->set.header = devm_kzalloc(sma1307->dev,
sma1307->set.header_size,
GFP_KERNEL);
sma1307->set.header = devm_kmalloc_array(sma1307->dev,
sma1307->set.header_size,
sizeof(int),
GFP_KERNEL);
if (!sma1307->set.header) {
sma1307->set.status = false;
return;