diff options
| author | Gustavo A. R. Silva <gustavoars@kernel.org> | 2023-09-15 22:09:11 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2023-10-02 16:06:25 +0300 |
| commit | 3746284c233d5cf5f456400e61cd4a46a69c6e8c (patch) | |
| tree | 571ccef3b60bf614a9ebd6d2ceabb59fd28997ee /sound/soc/sof | |
| parent | b87b8f43afd5f7afd3920532942f5e9ea028d955 (diff) | |
| download | linux-3746284c233d5cf5f456400e61cd4a46a69c6e8c.tar.xz | |
ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()
If, for any reason, the open-coded arithmetic causes a wraparound,
the protection that `struct_size()` adds against potential integer
overflows is defeated. Fix this by hardening call to `struct_size()`
with `size_add()`.
Fixes: f9efae954905 ("ASoC: SOF: ipc4-topology: Add support for base config extension")
Signed-off-by: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/ZQSr15AYJpDpipg6@work
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/sof')
| -rw-r--r-- | sound/soc/sof/ipc4-topology.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c index bf91c8786162..af90c14ad57a 100644 --- a/sound/soc/sof/ipc4-topology.c +++ b/sound/soc/sof/ipc4-topology.c @@ -895,7 +895,8 @@ static int sof_ipc4_widget_setup_comp_process(struct snd_sof_widget *swidget) if (process->init_config == SOF_IPC4_MODULE_INIT_CONFIG_TYPE_BASE_CFG_WITH_EXT) { struct sof_ipc4_base_module_cfg_ext *base_cfg_ext; u32 ext_size = struct_size(base_cfg_ext, pin_formats, - swidget->num_input_pins + swidget->num_output_pins); + size_add(swidget->num_input_pins, + swidget->num_output_pins)); base_cfg_ext = kzalloc(ext_size, GFP_KERNEL); if (!base_cfg_ext) { |