From ce05994566a82a16359bd704c202d48c711919ea Mon Sep 17 00:00:00 2001 From: Karthikeyan Mani Date: Wed, 7 Dec 2016 18:19:31 -0800 Subject: [PATCH] ASoC: wcd9320: Fix out of bounds for mad input value Add check in taiko_mad_input_put function to return error on out of bounds access using mad input value CRs-fixed: 1096799 CAF-Change-Id: I75ce9e881cf05a50e874a555b2f8bd3286cdaed4 Signed-off-by: Karthikeyan Mani CVE-2016-5858 [haggertk]: Backport to 3.4/msm8974 Change-Id: Ie28d6c34fd978098f45012f9d2f4b686100ce24b Signed-off-by: Francisco Franco --- sound/soc/codecs/wcd9320.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sound/soc/codecs/wcd9320.c b/sound/soc/codecs/wcd9320.c index 86adb9712378..0157bbc96dd8 100644 --- a/sound/soc/codecs/wcd9320.c +++ b/sound/soc/codecs/wcd9320.c @@ -1244,6 +1244,13 @@ static int taiko_mad_input_put(struct snd_kcontrol *kcontrol, taiko_mad_input = ucontrol->value.integer.value[0]; + if (taiko_mad_input >= ARRAY_SIZE(taiko_conn_mad_text)) { + dev_err(codec->dev, + "%s: taiko_mad_input = %d out of bounds\n", + __func__, taiko_mad_input); + return -EINVAL; + } + pr_debug("%s: taiko_mad_input = %s\n", __func__, taiko_conn_mad_text[taiko_mad_input]);