tree 9970815d2790b9ef9c959804b5d540b31758b069
parent 32bd60d5eca048fb91eed723799c0b4a847c18e4
author Samasth Norway Ananda <samasth.norway.ananda@oracle.com> 1757458271 -0700
committer Mark Brown <broonie@kernel.org> 1758230791 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmjMeQcACgkQJNaLcl1U
 h9D3kAf/aSzgrZyUet3DblXw+LPdER100y7s5YszE6DfOSKEWdnnUexU+P5tTQT0
 RMYOBvAKM2yfrTI/scTq849opcqOLCIkh7C3Oj9GBFBg6VTMZtqD5A3pKau+mTH+
 Ly/sDyfJxEqtbxvK1pdhPCU3EQn8MG52GAgF09AxR5KfLo6PQFkpwsrhNhpEwplz
 mJ9n6ROaRUzqDlrA2Wi/atOFIHtPzHGpjJeGpBYJgrJryofGSsli+Flh83Lojvmh
 1f2+tJSewBLt7x49z5BdSy6xZQ+vKBmbm2QlHHAAiHzeWR+upRsEfIvdKTMPQZAS
 8B1/XAYCl7Ipx4Ga7csyMXuweaElNQ==
 =BRtB
 -----END PGP SIGNATURE-----

ASoC: SOF: ipc3-dtrace: fix potential integer overflow in allocation

Fix a potential integer overflow vulnerability in trace_filter_parse()
where the allocation size calculation could overflow.

The issue occurs when:
1. capacity is calculated by adding TRACE_FILTER_ELEMENTS_PER_ENTRY in a
   loop for each entry found in the input string.
2. capacity * sizeof(**out) multiplication could overflow if many
   entries are present in the input.
3. This results in a smaller allocation than expected, leading to
   potential buffer overflow.

Replace kmalloc() with kmalloc_array() which provides built-in overflow
checking and will safely fail the allocation if overflow would occur,
preventing memory corruption.

Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
Link: https://patch.msgid.link/20250909225111.3740029-1-samasth.norway.ananda@oracle.com
Signed-off-by: Mark Brown <broonie@kernel.org>