ASoC: fsl: fsl_audmix: Validate written enum values

fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src()
convert the user-provided enum item with snd_soc_enum_item_to_val()
before checking whether the item is within the enum's item count.

The generic snd_soc_put_enum_double() helper performs that
validation, but these callbacks use the converted value first: the
clock-source path tests it with BIT(), and the output-source path
indexes the prms transition table with it.

Reject out-of-range enum items before converting them.

Fixes: be1df61cf06e ("ASoC: fsl: Add Audio Mixer CPU DAI driver")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260609124317.38046-4-sammiee5311@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/fsl/fsl_audmix.c b/sound/soc/fsl/fsl_audmix.c
index 40a3b7432174429640ad39af15c538defa9d0fba..f819f33ec46b841f172f84acbb247c5b6c87e22d 100644 (file)
--- a/sound/soc/fsl/fsl_audmix.c
+++ b/sound/soc/fsl/fsl_audmix.c
@@ -117,6 +117,9 @@ static int fsl_audmix_put_mix_clk_src(struct snd_kcontrol *kcontrol,
        unsigned int *item = ucontrol->value.enumerated.item;
        unsigned int reg_val, val, mix_clk;
 
+       if (item[0] >= e->items)
+               return -EINVAL;
+
        /* Get current state */
        reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);
        mix_clk = ((reg_val & FSL_AUDMIX_CTR_MIXCLK_MASK)
@@ -157,6 +160,9 @@ static int fsl_audmix_put_out_src(struct snd_kcontrol *kcontrol,
        unsigned int reg_val, val, mask = 0, ctr = 0;
        int ret;
 
+       if (item[0] >= e->items)
+               return -EINVAL;
+
        /* Get current state */
        reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);