Patch "ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()" has been added to the 6.5-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()

to the 6.5-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     asoc-sof-ipc4-topology-use-size_add-in-call-to-struc.patch
and it can be found in the queue-6.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 67d68e9fcc9ffaf20bee641670eabca5af5daf15
Author: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>
Date:   Fri Sep 15 13:09:11 2023 -0600

    ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()
    
    [ Upstream commit 3746284c233d5cf5f456400e61cd4a46a69c6e8c ]
    
    If, for any reason, the open-coded arithmetic causes a wraparound,
    the protection that `struct_size()` adds against potential integer
    overflows is defeated. Fix this by hardening call to `struct_size()`
    with `size_add()`.
    
    Fixes: f9efae954905 ("ASoC: SOF: ipc4-topology: Add support for base config extension")
    Signed-off-by: "Gustavo A. R. Silva" <gustavoars@xxxxxxxxxx>
    Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/ZQSr15AYJpDpipg6@work
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c
index 8fb6582e568e7..98ed20cafb573 100644
--- a/sound/soc/sof/ipc4-topology.c
+++ b/sound/soc/sof/ipc4-topology.c
@@ -882,7 +882,8 @@ static int sof_ipc4_widget_setup_comp_process(struct snd_sof_widget *swidget)
 	if (process->init_config == SOF_IPC4_MODULE_INIT_CONFIG_TYPE_BASE_CFG_WITH_EXT) {
 		struct sof_ipc4_base_module_cfg_ext *base_cfg_ext;
 		u32 ext_size = struct_size(base_cfg_ext, pin_formats,
-						swidget->num_input_pins + swidget->num_output_pins);
+					   size_add(swidget->num_input_pins,
+						    swidget->num_output_pins));
 
 		base_cfg_ext = kzalloc(ext_size, GFP_KERNEL);
 		if (!base_cfg_ext) {



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux