]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()
authorDan Carpenter <dan.carpenter@linaro.org>
Fri, 29 Aug 2025 12:57:34 +0000 (15:57 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Sep 2025 09:16:51 +0000 (11:16 +0200)
commitcd59ca8f75dbb42a67fcae975c766114644e36c4
tree5ffbbab7bb8e778a5bce71829b151d8cf65aea0a
parent7c28b31b2209ec9cb7d6d02b56b87b2b5359f0fa
ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()

[ Upstream commit 78338108b5a856dc98223a335f147846a8a18c51 ]

The sma1307->set.header_size is how many integers are in the header
(there are 8 of them) but instead of allocating space of 8 integers
we allocate 8 bytes.  This leads to memory corruption when we copy data
it on the next line:

        memcpy(sma1307->set.header, data,
               sma1307->set.header_size * sizeof(int));

Also since we're immediately copying over the memory in ->set.header,
there is no need to zero it in the allocator.  Use devm_kmalloc_array()
to allocate the memory instead.

Fixes: 576c57e6b4c1 ("ASoC: sma1307: Add driver for Iron Device SMA1307")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aLGjvjpueVstekXP@stanley.mountain
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
sound/soc/codecs/sma1307.c