Skip to content

Commit ce2335c

Browse files
samasth-norwaybroonie
authored andcommitted
ASoC: SOF: ipc3-dtrace: fix potential integer overflow in allocation
Fix a potential integer overflow vulnerability in trace_filter_parse() where the allocation size calculation could overflow. The issue occurs when: 1. capacity is calculated by adding TRACE_FILTER_ELEMENTS_PER_ENTRY in a loop for each entry found in the input string. 2. capacity * sizeof(**out) multiplication could overflow if many entries are present in the input. 3. This results in a smaller allocation than expected, leading to potential buffer overflow. Replace kmalloc() with kmalloc_array() which provides built-in overflow checking and will safely fail the allocation if overflow would occur, preventing memory corruption. Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> Link: https://patch.msgid.link/20250909225111.3740029-1-samasth.norway.ananda@oracle.com Signed-off-by: Mark Brown <broonie@kernel.org>
1 parent 32bd60d commit ce2335c

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

sound/soc/sof/ipc3-dtrace.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ static int trace_filter_parse(struct snd_sof_dev *sdev, char *string,
126126
capacity += TRACE_FILTER_ELEMENTS_PER_ENTRY;
127127
entry = strchr(entry + 1, entry_delimiter[0]);
128128
}
129-
*out = kmalloc(capacity * sizeof(**out), GFP_KERNEL);
129+
*out = kmalloc_array(capacity, sizeof(**out), GFP_KERNEL);
130130
if (!*out)
131131
return -ENOMEM;
132132

0 commit comments

Comments
 (0)