From: Takashi Iwai <tiwai@suse.de> mainline inclusion from mainline-v7.0-rc7 commit b045ab3dff97edae6d538eeff900a34c098761f8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14530 CVE: CVE-2026-31776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- SPDIF1 DAIO type isn't properly handled in daio_device_index() for hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds array access. Follow the hw20k1 pattern and return the proper index for this type, too. Reported-and-tested-by: Karsten Hohmeier <linux@hohmatik.de> Closes: https://lore.kernel.org/20260315155004.15633-1-linux@hohmatik.de Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20260329091240.420194-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Zhang Yuwei <zhangyuwei20@huawei.com> --- sound/pci/ctxfi/ctdaio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c index aae544dff886..11cb0d886e95 100644 --- a/sound/pci/ctxfi/ctdaio.c +++ b/sound/pci/ctxfi/ctdaio.c @@ -119,6 +119,7 @@ static unsigned int daio_device_index(enum DAIOTYP type, struct hw *hw) switch (type) { case SPDIFOO: return 0; case SPDIFIO: return 0; + case SPDIFI1: return 1; case LINEO1: return 4; case LINEO2: return 7; case LINEO3: return 5; -- 2.22.0