Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e1b790a8 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Mark Brown
Browse files

SoC: mxs-saif: check validity of ids in mxs_saif_probe() 



There is a check for validity of one of ids in mxs_saif_probe(),
while array dereferece is made by the other id.

The patch adds the check for the second saif id.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 1001354c

sound/soc/mxs/mxs-saif.c

+9 −4
Original line number Diff line number Diff line
@@ -735,6 +735,11 @@ static int mxs_saif_probe(struct platform_device *pdev) 
	else

		saif->id = ret;



	if (saif->id >= ARRAY_SIZE(mxs_saif)) {

		dev_err(&pdev->dev, "get wrong saif id\n");

		return -EINVAL;

	}



	/*

	 * If there is no "fsl,saif-master" phandle, it's a saif

	 * master.  Otherwise, it's a slave and its phandle points
@@ -749,12 +754,12 @@ static int mxs_saif_probe(struct platform_device *pdev) 
			return ret;

		else

			saif->master_id = ret;

	}



		if (saif->master_id >= ARRAY_SIZE(mxs_saif)) {

			dev_err(&pdev->dev, "get wrong master id\n");

			return -EINVAL;

		}

	}



	mxs_saif[saif->id] = saif;