This patch series fixes three memory-safety issues in
sdw_add_element_group_count() in drivers/soundwire.

1. Fix out-of-bounds memory access caused by incorrect boundary checks.
2. Increase group->max_size only after successful allocation to avoid
   leaving the group's state inconsistent if one allocation fails.
3. Use krealloc_array() to prevent integer overflow.

Baoli.Zhang (3):
  soundwire: fix bug in sdw_add_element_group_count found by syzkaller
  soundwire: increase group->max_size after allocation
  soundwire: use krealloc_array to prevent integer overflow

 .../soundwire/generic_bandwidth_allocation.c  | 44 +++++++++----------
 1 file changed, 20 insertions(+), 24 deletions(-)

-- 
2.43.0