mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-29 01:04:14 -04:00
HyeongJun An <sammiee5311@gmail.com> says: Some custom ASoC kcontrol put() handlers use the written enum value (ucontrol->value.enumerated.item[0]) to index a table or compute a bit shift before validating that the value is within the control's enum range. An out-of-range value written from userspace is therefore consumed before it is rejected. This is the same class addressed for the Meson codecs in commit1e00120680("ASoC: meson: g12a-tohdmitx: Validate written enum values") and commit3150b70e94("ASoC: meson: g12a-toacodec: Validate written enum values"). Fix four more instances: - hdac_hdmi reads e->texts[item] before validation. - aiu converts the item before validating it. - fsl_audmix converts the item and uses the result before validation. - tegra210_ahub reads e->values[item] before validation. Link: https://patch.msgid.link/20260609124317.38046-1-sammiee5311@gmail.com