diff options
| author | Cezary Rojewski <cezary.rojewski@intel.com> | 2025-05-30 16:10:23 +0200 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2025-06-02 12:26:50 +0100 |
| commit | 93e246b6769bdacb09cfff4ea0f00fe5ab4f0d7a (patch) | |
| tree | 83f778c05099a56b252c364cc62b1cf3d897d623 | |
| parent | 5f342aeee2724d31046172eb5caab8e0e8afd57d (diff) | |
ASoC: Intel: avs: Verify content returned by parse_int_array()
The first element of the returned array stores its length. If it is 0,
any manipulation beyond the element at index 0 ends with null-ptr-deref.
Fixes: 5a565ba23abe ("ASoC: Intel: avs: Probing and firmware tracing over debugfs")
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20250530141025.2942936-8-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
| -rw-r--r-- | sound/soc/intel/avs/debugfs.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sound/soc/intel/avs/debugfs.c b/sound/soc/intel/avs/debugfs.c index 8c4edda97f75..0e826ca20619 100644 --- a/sound/soc/intel/avs/debugfs.c +++ b/sound/soc/intel/avs/debugfs.c @@ -373,7 +373,10 @@ static ssize_t trace_control_write(struct file *file, const char __user *from, s return ret; num_elems = *array; - resource_mask = array[1]; + if (!num_elems) { + ret = -EINVAL; + goto free_array; + } /* * Disable if just resource mask is provided - no log priority flags. @@ -381,6 +384,7 @@ static ssize_t trace_control_write(struct file *file, const char __user *from, s * Enable input format: mask, prio1, .., prioN * Where 'N' equals number of bits set in the 'mask'. */ + resource_mask = array[1]; if (num_elems == 1) { ret = disable_logs(adev, resource_mask); } else { |