| Message ID | 20181221090442.GA2735@kadam (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | eef08e5350618b7a9fdc8ac5b821a925366c8f3f |
| Headers | show |
| Series | [1/2] ASoC: qdsp6: q6asm-dai: Off by one in of_q6asm_parse_dai_data() | expand |
On 21/12/2018 09:04, Dan Carpenter wrote: > The q6asm_fe_dais[] array has MAX_SESSIONS (8) elements so the > > comparison should be >= or we access one element beyond the end of the > array. > > Fixes: 22930c79ac5c ("ASoC: qdsp6: q6asm-dai: Add support to compress offload") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- Thanks for the patch! Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c index 5b986b74dd36..9d738b4c1e05 100644 --- a/sound/soc/qcom/qdsp6/q6asm-dai.c +++ b/sound/soc/qcom/qdsp6/q6asm-dai.c @@ -874,7 +874,7 @@ static int of_q6asm_parse_dai_data(struct device *dev, for_each_child_of_node(dev->of_node, node) { ret = of_property_read_u32(node, "reg", &id); - if (ret || id > MAX_SESSIONS || id < 0) { + if (ret || id >= MAX_SESSIONS || id < 0) { dev_err(dev, "valid dai id not found:%d\n", ret); continue; }
The q6asm_fe_dais[] array has MAX_SESSIONS (8) elements so the > comparison should be >= or we access one element beyond the end of the array. Fixes: 22930c79ac5c ("ASoC: qdsp6: q6asm-dai: Add support to compress offload") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- sound/soc/qcom/qdsp6/q6asm-dai.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)