ASoC: codecs: hdac_hdmi: Validate written enum value

hdac_hdmi_set_pin_port_mux() uses the written enum value to index the
texts array before calling snd_soc_dapm_put_enum_double(), which validates
that the value is within the enum item range.

An out-of-range value can therefore make the driver read past the texts
array before the helper rejects the write. Move the lookup after the helper
has accepted the value.

Fixes: 4a3478debf36 ("ASoC: hdac_hdmi: Add jack reporting")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260609124317.38046-2-sammiee5311@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 2652fcf2a3a345908d426b3a39f8e1fdb00688cf..3220f9226e0b262a9548d0988eea75b8ec8e3712 100644 (file)
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -911,12 +911,14 @@ static int hdac_hdmi_set_pin_port_mux(struct snd_kcontrol *kcontrol,
        struct hdac_device *hdev = dev_to_hdac_dev(dev);
        struct hdac_hdmi_priv *hdmi = hdev_to_hdmi_priv(hdev);
        struct hdac_hdmi_pcm *pcm;
-       const char *cvt_name =  e->texts[ucontrol->value.enumerated.item[0]];
+       const char *cvt_name;
 
        ret = snd_soc_dapm_put_enum_double(kcontrol, ucontrol);
        if (ret < 0)
                return ret;
 
+       cvt_name = e->texts[ucontrol->value.enumerated.item[0]];
+
        if (port == NULL)
                return -EINVAL;