Unverified Commit ce2335cd authored by Samasth Norway Ananda's avatar Samasth Norway Ananda Committed by Mark Brown
Browse files

ASoC: SOF: ipc3-dtrace: fix potential integer overflow in allocation 



Fix a potential integer overflow vulnerability in trace_filter_parse()
where the allocation size calculation could overflow.

The issue occurs when:
1. capacity is calculated by adding TRACE_FILTER_ELEMENTS_PER_ENTRY in a
   loop for each entry found in the input string.
2. capacity * sizeof(**out) multiplication could overflow if many
   entries are present in the input.
3. This results in a smaller allocation than expected, leading to
   potential buffer overflow.

Replace kmalloc() with kmalloc_array() which provides built-in overflow
checking and will safely fail the allocation if overflow would occur,
preventing memory corruption.

Signed-off-by: default avatarSamasth Norway Ananda <samasth.norway.ananda@oracle.com>
Link: https://patch.msgid.link/20250909225111.3740029-1-samasth.norway.ananda@oracle.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 32bd60d5

sound/soc/sof/ipc3-dtrace.c

+1 −1
Original line number Diff line number Diff line
@@ -126,7 +126,7 @@ static int trace_filter_parse(struct snd_sof_dev *sdev, char *string, 
		capacity += TRACE_FILTER_ELEMENTS_PER_ENTRY;

		entry = strchr(entry + 1, entry_delimiter[0]);

	}

	*out = kmalloc(capacity * sizeof(**out), GFP_KERNEL);

	*out = kmalloc_array(capacity, sizeof(**out), GFP_KERNEL);

	if (!*out)

		return -ENOMEM;