Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-29 15:41:36 +00:00
Code Issues Packages Projects Releases Wiki Activity
9f34290421
linux/sound
History
Hui Wang 9f34290421
ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t 
The CS35L41_NUM_OTP_ELEM is 100, but only 99 entries are defined in
the array otp_map_1/2[CS35L41_NUM_OTP_ELEM], this will trigger UBSAN
to report a shift-out-of-bounds warning in the cs35l41_otp_unpack()
since the last entry in the array will result in GENMASK(-1, 0).

UBSAN reports this problem:
 UBSAN: shift-out-of-bounds in /home/hwang4/build/jammy/jammy/sound/soc/codecs/cs35l41-lib.c:836:8
 shift exponent 64 is too large for 64-bit type 'long unsigned int'
 CPU: 10 PID: 595 Comm: systemd-udevd Not tainted 5.15.0-23-generic #23
 Hardware name: LENOVO \x02MFG_IN_GO/\x02MFG_IN_GO, BIOS N3GET19W (1.00 ) 03/11/2022
 Call Trace:
  <TASK>
  show_stack+0x52/0x58
  dump_stack_lvl+0x4a/0x5f
  dump_stack+0x10/0x12
  ubsan_epilogue+0x9/0x45
  __ubsan_handle_shift_out_of_bounds.cold+0x61/0xef
  ? regmap_unlock_mutex+0xe/0x10
  cs35l41_otp_unpack.cold+0x1c6/0x2b2 [snd_soc_cs35l41_lib]
  cs35l41_hda_probe+0x24f/0x33a [snd_hda_scodec_cs35l41]
  cs35l41_hda_i2c_probe+0x65/0x90 [snd_hda_scodec_cs35l41_i2c]
  ? cs35l41_hda_i2c_remove+0x20/0x20 [snd_hda_scodec_cs35l41_i2c]
  i2c_device_probe+0x252/0x2b0

Fixes: 6450ef5590 ("ASoC: cs35l41: CS35L41 Boosted Smart Amplifier")
Reviewed-by: Lucas Tanure <tanureal@opensource.cirrus.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20220328123535.50000-2-hui.wang@canonical.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-04-05 10:23:16 +01:00
..
ac97
aoa Kbuild updates for v5.15 2021-09-03 15:33:47 -07:00
arm ALSA: pxa2xx: Use managed PCM buffer allocation 2021-08-04 08:08:21 +02:00
atmel
core sound fixes for 5.18-rc1 2022-04-01 10:32:46 -07:00
drivers ALSA: virmidi: Remove duplicated code 2022-01-06 16:08:18 +01:00
firewire ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction 2022-03-04 17:23:21 +01:00
hda ASoC: Updates for v5.18 2022-03-21 16:19:21 +01:00
i2c
isa ALSA: cs4236: fix an incorrect NULL check on list iterator 2022-03-27 10:32:42 +02:00
mips ALSA: mips: Use platform_get_irq() to get the interrupt 2022-02-28 16:59:01 +01:00
oss
parisc parisc architecture updates for kernel 5.15: 2021-09-02 13:16:00 -07:00
pci sound fixes for 5.18-rc1 2022-04-01 10:32:46 -07:00
pcmcia
ppc powerpc/machdep: Move sys_ctrler_t definition into pmac_feature.h 2022-02-07 21:02:20 +11:00
sh
soc ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t 2022-04-05 10:23:16 +01:00
sparc ALSA: sparc: no need to initialise statics to 0 2021-12-12 10:01:04 +01:00
spi sound updates for 5.18 2022-03-23 15:11:12 -07:00
synth ALSA: synth: missing check for possible NULL after the call to kstrdup 2021-11-09 07:18:50 +01:00
usb Merge branch 'for-next' into for-linus 2022-03-21 16:18:34 +01:00
virtio virtio: wrap config->reset calls 2022-01-14 18:50:52 -05:00
x86 ALSA: x86: Use standard mmap helper for Intel HDMI LPE audio 2022-03-05 09:33:48 +01:00
xen xen/grant-table: remove readonly parameter from functions 2022-03-15 20:34:40 -05:00
ac97_bus.c
Kconfig
last.c
Makefile
sound_core.c sound: core: Remove redundant variable and return the last statement 2022-02-28 17:57:14 +01:00