linux-kernel - [bug report] ASoC: codecs: ACF bin parsing and check library file for aw88395

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYXvkD03l40F-OZ9@stanley.mountain>
Date: Fri, 6 Feb 2026 16:41:36 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Weidong Wang <wangweidong.a@...nic.com>
Cc: linux-sound@...r.kernel.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: [bug report] ASoC: codecs: ACF bin parsing and check library file
 for aw88395

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Weidong Wang,

Commit 4345865b003b ("ASoC: codecs: ACF bin parsing and check library
file for aw88395") from Jan 13, 2023 (linux-next), leads to the
following Smatch static checker warning:

	sound/soc/codecs/aw88395/aw88395_lib.c:712 aw_dev_create_prof_name_list_v1()
	warn: double check that we're allocating correct size: 8 vs 32

sound/soc/codecs/aw88395/aw88395_lib.c
    701 static int aw_dev_create_prof_name_list_v1(struct aw_device *aw_dev)
    702 {
    703         struct aw_prof_info *prof_info = &aw_dev->prof_info;
    704         struct aw_prof_desc *prof_desc = prof_info->prof_desc;
    705         int i;
    706 
    707         if (!prof_desc) {
    708                 dev_err(aw_dev->dev, "prof_desc is NULL");
    709                 return -EINVAL;
    710         }
    711 
--> 712         prof_info->prof_name_list = devm_kzalloc(aw_dev->dev,
    713                                         prof_info->count * PROFILE_STR_MAX,
                                                                   ^^^^^^^^^^^^^^^
PROFILE_STR_MAX this is the maximum length of the string but we only
need to allocate a pointer to the string sizeof(char *).  So this
allocates 32bytes instead of just 8.

It's a small waste of space but otherwise it's harmless.

    714                                         GFP_KERNEL);
    715         if (!prof_info->prof_name_list)
    716                 return -ENOMEM;
    717 
    718         for (i = 0; i < prof_info->count; i++) {
    719                 prof_desc[i].id = i;
    720                 prof_info->prof_name_list[i] = prof_desc[i].prf_str;
    721                 dev_dbg(aw_dev->dev, "prof name is %s", prof_info->prof_name_list[i]);
    722         }
    723 
    724         return 0;
    725 }

regards,
dan carpenter