ASoC: tegra: tegra210_ahub: Validate written enum value

tegra_ahub_put_value_enum() reads e->values[item[0]] before
checking whether item[0] is within the enum item range. The existing
check therefore happens too late to prevent an out-of-range read of the
values array.

Move the check before the array access.

Fixes: 16e1bcc2caf4 ("ASoC: tegra: Add Tegra210 based AHUB driver")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260609124317.38046-5-sammiee5311@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c
index ece33b7ff190ac03c4eefc01e4a78caf8f6c0f67..efc8f338866828fdd652ef2186d6aa201e9cd7fa 100644 (file)
--- a/sound/soc/tegra/tegra210_ahub.c
+++ b/sound/soc/tegra/tegra210_ahub.c
@@ -62,13 +62,15 @@ static int tegra_ahub_put_value_enum(struct snd_kcontrol *kctl,
        struct snd_soc_dapm_update update[TEGRA_XBAR_UPDATE_MAX_REG] = { };
        int val_bytes = snd_soc_component_regmap_val_bytes(cmpnt);
        unsigned int *item = uctl->value.enumerated.item;
-       unsigned int value = e->values[item[0]];
+       unsigned int value;
        unsigned int i, bit_pos, reg_idx = 0, reg_val = 0;
        int change = 0;
 
        if (item[0] >= e->items)
                return -EINVAL;
 
+       value = e->values[item[0]];
+
        if (value) {
                /* Get the register index and value to set */
                reg_idx = (value - 1) / (8 * val_bytes);