Merge tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A standard set of driver-specific fixes and quirks accumulated since
  the merge window:

  ASoC:
   - SOF: Sanity check to prevent OOB reads
   - rsnd: Fix clock leak and double-disable issues with PM
   - tas675x: Misc fixes for register fields, etc
   - lpass-va-macro: Correct codec version for Qualcomm SC7280
   - amd-yc: DMIC quirk for Alienware m15 R7 AMD

  Others:
   - us144mkii: Fix a UAF on disconnect and anchor list corruption
   - HD-audio: Realtek quirks for HP models"

* tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ASoC: rsnd: src: Add missing scu_supply clock to suspend/resume
  Documentation: sound: tas675x: Fix temperature range and impedance documentation
  ASoC: codecs: tas675x: Fix CHx temperature range register bit fields
  ASoC: codecs: tas675x: use READ_ONCE for params to be used concurrently
  ASoC: rsnd: adg: make rsnd_adg_clk_control() idempotent
  ASoC: SOF: validate probe info element counts
  ALSA: usx2y: us144mkii: fix work UAF on disconnect
  ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
  ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED
  MAINTAINERS: ASoC: SOF: add AMD reviewer for Sound Open Firmware
  ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
  ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

1 files changed, 10 insertions, 1 deletions

diff --git a/sound/soc/sof/sof-client-probes-ipc4.c b/sound/soc/sof/sof-client-probes-ipc4.c
index 88397c7dc4c3..2eef32b55395 100644
--- a/sound/soc/sof/sof-client-probes-ipc4.c
+++ b/sound/soc/sof/sof-client-probes-ipc4.c
@@ -248,10 +248,19 @@ static int ipc4_probes_points_info(struct sof_client_dev *cdev,
 		return ret;
 	}
 	info = msg.data_ptr;
+	if (msg.data_size < sizeof(*info) ||
+	    info->num_elems > (msg.data_size - sizeof(*info)) /
+			      sizeof(info->points[0])) {
+		dev_err(dev, "%s: invalid probe info element count %u\n",
+			__func__, info->num_elems);
+		kfree(msg.data_ptr);
+		return -EINVAL;
+	}
+
 	*num_desc = info->num_elems;
 	dev_dbg(dev, "%s: got %zu probe points", __func__, *num_desc);
 
-	*desc = kzalloc(*num_desc * sizeof(**desc), GFP_KERNEL);
+	*desc = kcalloc(*num_desc, sizeof(**desc), GFP_KERNEL);
 	if (!*desc) {
 		kfree(msg.data_ptr);
 		return -ENOMEM;