Unverified Commit 06feec60 authored by Dmitry Osipenko's avatar Dmitry Osipenko Committed by Mark Brown
Browse files

ASoC: hdmi-codec: Fix OOB memory accesses 



Correct size of iec_status array by changing it to the size of status
array of the struct snd_aes_iec958. This fixes out-of-bounds slab
read accesses made by memcpy() of the hdmi-codec driver. This problem
is reported by KASAN.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarDmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20220112195039.1329-1-digetx@gmail.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent fb25621d

include/uapi/sound/asound.h

+3 −1
Original line number Diff line number Diff line
@@ -56,8 +56,10 @@ 
 *                                                                          *

 ****************************************************************************/



#define AES_IEC958_STATUS_SIZE		24



struct snd_aes_iec958 {

	unsigned char status[24];	/* AES/IEC958 channel status bits */

	unsigned char status[AES_IEC958_STATUS_SIZE]; /* AES/IEC958 channel status bits */

	unsigned char subcode[147];	/* AES/IEC958 subcode bits */

	unsigned char pad;		/* nothing */

	unsigned char dig_subframe[4];	/* AES/IEC958 subframe bits */

sound/soc/codecs/hdmi-codec.c

+1 −1
Original line number Diff line number Diff line
@@ -277,7 +277,7 @@ struct hdmi_codec_priv { 
	bool busy;

	struct snd_soc_jack *jack;

	unsigned int jack_status;

	u8 iec_status[5];

	u8 iec_status[AES_IEC958_STATUS_SIZE];

};



static const struct snd_soc_dapm_widget hdmi_widgets[] = {