From: Charles Keepax Date: Wed, 22 Jul 2026 10:35:00 +0000 (+0100) Subject: ASoC: SDCA: Ensure that Control Range is large enough for header X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=951e921b039b793bef7050eaf5c5fb1a4a5341d1;p=thirdparty%2Flinux.git ASoC: SDCA: Ensure that Control Range is large enough for header When reading the Ranges structure from an SDCA Control, ensure that the read data is large enough to encompass the required header before accessing it. Fixes: 64fb5af1d1bb ("ASoC: SDCA: Add parsing for Control range structures") Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260722103500.872714-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown --- diff --git a/sound/soc/sdca/sdca_functions.c b/sound/soc/sdca/sdca_functions.c index 77940bd6b33c..7a7a9f1a4938 100644 --- a/sound/soc/sdca/sdca_functions.c +++ b/sound/soc/sdca/sdca_functions.c @@ -855,6 +855,8 @@ static int find_sdca_control_range(struct device *dev, return 0; else if (num_range < 0) return num_range; + else if (num_range < 2 * sizeof(*limits)) + return -EINVAL; range_list = devm_kcalloc(dev, num_range, sizeof(*range_list), GFP_KERNEL); if (!range_list)