Merge tag 'sound-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound updates from Takashi Iwai:
 "It's been a fairly calm development cycle. There are a few last-minute
  ALSA core fixes, most notably for covering PCM ioctl races, but the
  most of rest are device-specific changes.

  Below are some highlights:

  ALSA core:

   - Fixes for PCM ioctl races that may lead to UAF

   - Fix for oversized allocations in PCM OSS layer

  ASoC:

   - Start of moving SoF to support multiple IPC mechanisms

   - Use of NHLT ACPI table to reduce the amount of quirking required
     for Intel systems

   - Preliminary works forthcoming Intel AVS driver for legacy Intel DSP
     firmwares

   - Support for AMD PDM, Atmel PDMC, Awinic AW8738, i.MX cards with
     TLV320AIC31xx, Intel machines with CS35L41 and ESSX8336, Mediatek
     MT8181 wideband bluetooth, nVidia Tegra234, Qualcomm SC7280,
     Renesas RZ/V2L, Texas Instruments TAS585M

  HD-audio:

   - Driver re-binding fix for HD-audio

   - Updates for Intel ADL and Tegra234, various platform quirks for
     Dell, HP, Lenovo, ASUS, Samsung and Clevo machines

  USB-audio:

   - Quirk updates for Scarlett2, RODE, Corsair devices"

* tag 'sound-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (486 commits)
  ALSA: hda/realtek: Add alc256-samsung-headphone fixup
  ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
  ALSA: pcm: Add stream lock during PCM reset ioctl operations
  ALSA: pcm: Fix races among concurrent prealloc proc writes
  ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
  ALSA: pcm: Fix races among concurrent read/write and buffer changes
  ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
  ASoC: atmel: mchp-pdmc: print the correct property name
  MAINTAINERS: Add Shengjiu to maintainer list of sound/soc/fsl
  ASoC: SOF: Add a new dai_get_clk topology IPC op
  ASoC: SOF: topology: Add ops for setting up and tearing down pipelines
  ASoC: SOF: expose sof_route_setup()
  ASoC: SOF: Add dai_link_fixup PCM op for IPC3
  ASoC: SOF: Add trigger PCM op for IPC3
  ASoC: SOF: Define hw_params PCM op for IPC3
  ASoC: SOF: Introduce IPC3 PCM hw_free op
  ASoC: SOF: pcm: expose the sof_pcm_setup_connected_widgets() function
  ASoC: SOF: Introduce IPC-specific PCM ops
  ASoC: SOF: Add bytes_ext control IPC ops for IPC3
  ASoC: SOF: Add bytes_get/put control IPC ops for IPC3
  ...

1 files changed, 4 insertions, 1 deletions

diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
index 061ba06bc926..82e180c776ae 100644
--- a/sound/core/oss/pcm_plugin.c
+++ b/sound/core/oss/pcm_plugin.c
@@ -62,7 +62,10 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t
 	width = snd_pcm_format_physical_width(format->format);
 	if (width < 0)
 		return width;
-	size = frames * format->channels * width;
+	size = array3_size(frames, format->channels, width);
+	/* check for too large period size once again */
+	if (size > 1024 * 1024)
+		return -ENOMEM;
 	if (snd_BUG_ON(size % 8))
 		return -ENXIO;
 	size /= 8;