[PATCH 3/4] ASoC: fsl: fsl_audmix: Validate written enum values

[PATCH 3/4] ASoC: fsl: fsl_audmix: Validate written enum values

[HyeongJun An]

fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src()
convert the user-provided enum item with snd_soc_enum_item_to_val()
before checking whether the item is within the enum's item count.

The generic snd_soc_put_enum_double() helper performs that
validation, but these callbacks use the converted value first: the
clock-source path tests it with BIT(), and the output-source path
indexes the prms transition table with it.

Reject out-of-range enum items before converting them.

Fixes: be1df61cf06e ("ASoC: fsl: Add Audio Mixer CPU DAI driver")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
---
 sound/soc/fsl/fsl_audmix.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/soc/fsl/fsl_audmix.c b/sound/soc/fsl/fsl_audmix.c
index 40a3b7432174..f819f33ec46b 100644
--- a/sound/soc/fsl/fsl_audmix.c
+++ b/sound/soc/fsl/fsl_audmix.c
@@ -117,6 +117,9 @@ static int fsl_audmix_put_mix_clk_src(struct snd_kcontrol *kcontrol,
 	unsigned int *item = ucontrol->value.enumerated.item;
 	unsigned int reg_val, val, mix_clk;
 
+	if (item[0] >= e->items)
+		return -EINVAL;
+
 	/* Get current state */
 	reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);
 	mix_clk = ((reg_val & FSL_AUDMIX_CTR_MIXCLK_MASK)
@@ -157,6 +160,9 @@ static int fsl_audmix_put_out_src(struct snd_kcontrol *kcontrol,
 	unsigned int reg_val, val, mask = 0, ctr = 0;
 	int ret;
 
+	if (item[0] >= e->items)
+		return -EINVAL;
+
 	/* Get current state */
 	reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);
 
-- 
2.43.0

Re: [PATCH 3/4] ASoC: fsl: fsl_audmix: Validate written enum values

[Shengjiu Wang]

On Tue, Jun 9, 2026 at 8:47 PM HyeongJun An <sammiee5311@gmail.com> wrote:
>
> fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src()
> convert the user-provided enum item with snd_soc_enum_item_to_val()
> before checking whether the item is within the enum's item count.
>
> The generic snd_soc_put_enum_double() helper performs that
> validation, but these callbacks use the converted value first: the
> clock-source path tests it with BIT(), and the output-source path
> indexes the prms transition table with it.
>
> Reject out-of-range enum items before converting them.
>
> Fixes: be1df61cf06e ("ASoC: fsl: Add Audio Mixer CPU DAI driver")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>

Acked-by: Shengjiu Wang <shengjiu.wang@gmail.com>

Best regards
Shengjiu Wang
> ---
>  sound/soc/fsl/fsl_audmix.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/sound/soc/fsl/fsl_audmix.c b/sound/soc/fsl/fsl_audmix.c
> index 40a3b7432174..f819f33ec46b 100644
> --- a/sound/soc/fsl/fsl_audmix.c
> +++ b/sound/soc/fsl/fsl_audmix.c
> @@ -117,6 +117,9 @@ static int fsl_audmix_put_mix_clk_src(struct snd_kcontrol *kcontrol,
>         unsigned int *item = ucontrol->value.enumerated.item;
>         unsigned int reg_val, val, mix_clk;
>
> +       if (item[0] >= e->items)
> +               return -EINVAL;
> +
>         /* Get current state */
>         reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);
>         mix_clk = ((reg_val & FSL_AUDMIX_CTR_MIXCLK_MASK)
> @@ -157,6 +160,9 @@ static int fsl_audmix_put_out_src(struct snd_kcontrol *kcontrol,
>         unsigned int reg_val, val, mask = 0, ctr = 0;
>         int ret;
>
> +       if (item[0] >= e->items)
> +               return -EINVAL;
> +
>         /* Get current state */
>         reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);
>
> --
> 2.43.0
>