ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
stable inclusion from stable-v5.10.177 commit baef27176ea5fdc7ad0947e2dc7733855e35db71 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88YNP Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=baef27176ea5fdc7ad0947e2dc7733855e35db71 -------------------------------- [ Upstream commit 98e5eb11 ] tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A). static int tuning_ctl_set(...) { for (i = 0; i < TUNING_CTLS_COUNT; i++) (A) if (nid == ca0132_tuning_ctls[i].nid) break; snd_hda_power_up(...); (X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); snd_hda_power_down(...); ^ return 1; } We will get below error by cppcheck sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 for (i = 0; i < TUNING_CTLS_COUNT; i++) ^ sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, ^ This patch cares non match case. Signed-off-by:Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://lore.kernel.org/r/87sfe9eap7.wl-kuninori.morimoto.gx@renesas.com Signed-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
Sasha Levin <sashal@kernel.org> Signed-off-by:
sanglipeng <sanglipeng1@jd.com> (cherry picked from commit e2740dda)
Loading
Please sign in to comment