From nobody Mon Apr 27 16:13:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 078C6CCA47B for ; Fri, 10 Jun 2022 16:59:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350026AbiFJQ7B (ORCPT ); Fri, 10 Jun 2022 12:59:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350035AbiFJQ6c (ORCPT ); Fri, 10 Jun 2022 12:58:32 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF8B010C3 for ; Fri, 10 Jun 2022 09:58:30 -0700 (PDT) Received: from BUMER.localdomain (unknown [93.175.1.252]) by mail.ispras.ru (Postfix) with ESMTPSA id 1C7FC40737C0; Fri, 10 Jun 2022 16:58:21 +0000 (UTC) From: Daniil Dementev To: Jaroslav Kysela Cc: Daniil Dementev , Takashi Iwai , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov Subject: [PATCH] ALSA: usb-audio: US16x08: Move overflow check before array access Date: Fri, 10 Jun 2022 19:57:32 +0300 Message-Id: <20220610165732.2904-1-d.dementev@ispras.ru> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Buffer overflow could occur in the loop "while", due to accessing an array element before checking the index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Daniil Dementev Reviewed-by: Alexey Khoroshilov --- sound/usb/mixer_us16x08.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c index b7b6f3834ed5..6eb7d93b358d 100644 --- a/sound/usb/mixer_us16x08.c +++ b/sound/usb/mixer_us16x08.c @@ -637,10 +637,10 @@ static int snd_get_meter_comp_index(struct snd_us16x0= 8_meter_store *store) } } else { /* skip channels with no compressor active */ - while (!store->comp_store->val[ + while (store->comp_index <=3D SND_US16X08_MAX_CHANNELS + && !store->comp_store->val[ COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)] - [store->comp_index - 1] - && store->comp_index <=3D SND_US16X08_MAX_CHANNELS) { + [store->comp_index - 1]) { store->comp_index++; } ret =3D store->comp_index++; --=20 2.35.1.windows.2