• Gergo Koteles's avatar
    ASoC: tas2781: check the validity of prm_no/cfg_no · f32c80d3
    Gergo Koteles authored
    Add additional checks for program/config numbers to avoid loading from
    invalid addresses.
    
    If prm_no/cfg_no is negative, skip uploading program/config.
    
    The tas2781-hda driver caused a NULL pointer dereference after loading
    module, and before first runtime_suspend.
    
    the state was:
    tas_priv->cur_conf = -1;
    tas_priv->tasdevice[i].cur_conf = 0;
    program = &(tas_fmw->programs[-1]);
    
    BUG: kernel NULL pointer dereference, address: 0000000000000010
    Call Trace:
     <TASK>
     ? __die+0x23/0x70
     ? page_fault_oops+0x171/0x4e0
     ? vprintk_emit+0x175/0x2b0
     ? exc_page_fault+0x7f/0x180
     ? asm_exc_page_fault+0x26/0x30
     ? tasdevice_load_block_kernel+0x21/0x310 [snd_soc_tas2781_fmwlib]
     tasdevice_select_tuningprm_cfg+0x268/0x3a0 [snd_soc_tas2781_fmwlib]
     tasdevice_tuning_switch+0x69/0x710 [snd_soc_tas2781_fmwlib]
     tas2781_hda_playback_hook+0xd4/0x110 [snd_hda_scodec_tas2781_i2c]
    
    Fixes: 915f5ead ("ASoC: tas2781: firmware lib")
    CC:  <stable@vger.kernel.org>
    Signed-off-by: default avatarGergo Koteles <soyer@irl.hu>
    Link: https://msgid.link/r/523780155bfdca9bc0acd39efc79ed039454818d.1702591356.git.soyer@irl.huSigned-off-by: default avatarMark Brown <broonie@kernel.org>
    f32c80d3
tas2781-fmwlib.c 58.9 KB