diff mbox

ASoC: qdsp6: q6routing: off by one in routing_hw_params()

Message ID 20180713151100.x5usbqhlhrzjmeoq@kili.mountain (mailing list archive)
State Accepted
Commit 090345ce7265dd111299e3a63cdc79c3ef924481
Headers show

Commit Message

Dan Carpenter July 13, 2018, 3:11 p.m. UTC 
The data->port_data[] array has AFE_MAX_PORTS elements so the check
should be >= instead of > or we write one element beyond the end of the
array.

Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Srinivas Kandagatla July 13, 2018, 3:42 p.m. UTC | #1 
On 13/07/18 16:11, Dan Carpenter wrote:
> The data->port_data[] array has AFE_MAX_PORTS elements so the check
> should be >= instead of > or we write one element beyond the end of the
> array.
> 
> Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks for the fix,

Acked-by: Srinivas Kandgatla <srinivas.kandagatla@linaro.org>

> 
> diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
> index 35269b492761..0e7cf9e35d51 100644
> --- a/sound/soc/qcom/qdsp6/q6routing.c
> +++ b/sound/soc/qcom/qdsp6/q6routing.c
> @@ -927,7 +927,7 @@ static int routing_hw_params(struct snd_pcm_substream *substream,
>   	else
>   		path_type = ADM_PATH_LIVE_REC;
>   
> -	if (be_id > AFE_MAX_PORTS)
> +	if (be_id >= AFE_MAX_PORTS)
>   		return -EINVAL;
>   
>   	session = &data->port_data[be_id];
>
diff mbox

Patch

diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
index 35269b492761..0e7cf9e35d51 100644
--- a/sound/soc/qcom/qdsp6/q6routing.c
+++ b/sound/soc/qcom/qdsp6/q6routing.c
@@ -927,7 +927,7 @@  static int routing_hw_params(struct snd_pcm_substream *substream,
 	else
 		path_type = ADM_PATH_LIVE_REC;
 
-	if (be_id > AFE_MAX_PORTS)
+	if (be_id >= AFE_MAX_PORTS)
 		return -EINVAL;
 
 	session = &data->port_data[be_id];