[PATCH] ASoC: SDCA: Validate written enum value in ge_put_enum_double()

[PATCH] ASoC: SDCA: Validate written enum value in ge_put_enum_double()

[HyeongJun An]

ge_put_enum_double() passes the user-supplied enumeration index
item[0] to snd_soc_enum_item_to_val() without checking it against the
number of items in the enum:

	ret = snd_soc_enum_item_to_val(e, item[0]);

snd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array
with that index (e->values is set from a devm_kcalloc() of e->items
entries), so a control write with an out-of-range item[0] reads past the
end of the values buffer.  The bounds check in
snd_soc_dapm_put_enum_double() only runs afterwards, so it does not
prevent the read here.

Reject an out-of-range item before using it, matching the other enum put
handlers.

This issue was pointed out by the Sashiko AI review bot while reviewing a
related enum-validation series:
https://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/

Fixes: 812ff1baa764 ("ASoC: SDCA: Limit values user can write to Selected Mode")
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
---
 sound/soc/sdca/sdca_asoc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/soc/sdca/sdca_asoc.c b/sound/soc/sdca/sdca_asoc.c
index e76afa396b0a..b4dedba719dc 100644
--- a/sound/soc/sdca/sdca_asoc.c
+++ b/sound/soc/sdca/sdca_asoc.c
@@ -160,6 +160,9 @@ static int ge_put_enum_double(struct snd_kcontrol *kcontrol,
 	unsigned int reg = e->reg;
 	int ret;
 
+	if (item[0] >= e->items)
+		return -EINVAL;
+
 	reg &= ~SDW_SDCA_CTL_CSEL(0x3F);
 	reg |= SDW_SDCA_CTL_CSEL(SDCA_CTL_GE_DETECTED_MODE);
 
-- 
2.43.0

Re: [PATCH] ASoC: SDCA: Validate written enum value in ge_put_enum_double()

[Charles Keepax]

On Tue, Jun 23, 2026 at 08:05:26PM +0900, HyeongJun An wrote:
> ge_put_enum_double() passes the user-supplied enumeration index
> item[0] to snd_soc_enum_item_to_val() without checking it against the
> number of items in the enum:
> 
> 	ret = snd_soc_enum_item_to_val(e, item[0]);
> 
> snd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array
> with that index (e->values is set from a devm_kcalloc() of e->items
> entries), so a control write with an out-of-range item[0] reads past the
> end of the values buffer.  The bounds check in
> snd_soc_dapm_put_enum_double() only runs afterwards, so it does not
> prevent the read here.
> 
> Reject an out-of-range item before using it, matching the other enum put
> handlers.
> 
> This issue was pointed out by the Sashiko AI review bot while reviewing a
> related enum-validation series:
> https://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/
> 
> Fixes: 812ff1baa764 ("ASoC: SDCA: Limit values user can write to Selected Mode")
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
> ---

Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>

Thanks,
Charles

Re: [PATCH] ASoC: SDCA: Validate written enum value in ge_put_enum_double()

[Mark Brown]

On Tue, 23 Jun 2026 20:05:26 +0900, HyeongJun An wrote:
> ASoC: SDCA: Validate written enum value in ge_put_enum_double()

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-7.2

Thanks!

[1/1] ASoC: SDCA: Validate written enum value in ge_put_enum_double()
      https://git.kernel.org/broonie/sound/c/1ce42a11bed1

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark