From nobody Sat Apr 11 07:09:59 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 792FCC64EC4 for ; Fri, 3 Mar 2023 12:13:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229959AbjCCMNE (ORCPT ); Fri, 3 Mar 2023 07:13:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60338 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229451AbjCCMNC (ORCPT ); Fri, 3 Mar 2023 07:13:02 -0500 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4BCB6B47A for ; Fri, 3 Mar 2023 04:12:59 -0800 (PST) Received: from pps.filterd (m0279862.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 323BtqGr014942; Fri, 3 Mar 2023 12:12:36 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h=from : to : cc : subject : date : message-id : mime-version : content-type; s=qcppdkim1; bh=2GNAj3EuJVAUcJBgWkxCw7JKJx5QFlm4Tp4FLCSGW8Q=; b=cjHZB/41jACr8mmR5lEBEa7xl+2F/U/BI15eonbks5FG0UcmXIH7+toDt+DqJXtutSdP 8NkuHKjmRlWRf+i9HWCVbFlE7vIl0eIwt+PmMwhNp6g95NfiuQoeZF2m60DdCziF2JsO Pe5Yw1cQZTdfrZE7uwI8CX3b4D7MzOjSsG5w2fiIj6W7LFGiEAVPx4yi5oMPgYeuvMej IC6q0I+6K+b9XEcCR8hkBvKDtWmCLpCYLLJCw5uioH05t8P8GpL23rFJcw1kFhAiWZeT oDlghPywhyYQs4qokCOt93C1cAm/9Sfy74kATPsJdiHwUk1D0jrIwIuhlKKG7ZU5TUVw ZQ== Received: from nasanppmta05.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3p3dfrgm5f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 03 Mar 2023 12:12:35 +0000 Received: from nasanex01a.na.qualcomm.com ([10.52.223.231]) by NASANPPMTA05.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTPS id 323CCZmZ023020 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 3 Mar 2023 12:12:35 GMT Received: from hu-visr-hyd.qualcomm.com (10.80.80.8) by nasanex01a.na.qualcomm.com (10.52.223.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.41; Fri, 3 Mar 2023 04:12:32 -0800 From: Ravulapati Vishnu Vardhan Rao CC: , Srinivas Kandagatla , Banajit Goswami , Liam Girdwood , Mark Brown , Jaroslav Kysela , Takashi Iwai , "moderated list:QCOM AUDIO (ASoC) DRIVERS" , open list Subject: [PATCH] ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds Date: Fri, 3 Mar 2023 17:42:06 +0530 Message-ID: <20230303121206.22177-1-quic_visr@quicinc.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01b.na.qualcomm.com (10.46.141.250) To nasanex01a.na.qualcomm.com (10.52.223.231) X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-GUID: 4Uc6POTNL_B4seard9bD3gRzsbenN80t X-Proofpoint-ORIG-GUID: 4Uc6POTNL_B4seard9bD3gRzsbenN80t X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-03_01,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 phishscore=0 adultscore=0 impostorscore=0 bulkscore=0 mlxlogscore=987 clxscore=1011 priorityscore=1501 malwarescore=0 lowpriorityscore=0 spamscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303030106 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: visr When we run syzkaller we get below Out of Bound. "KASAN: slab-out-of-bounds Read in regcache_flat_read" Below is the backtrace of the issue: dump_backtrace+0x0/0x4c8 show_stack+0x34/0x44 dump_stack_lvl+0xd8/0x118 print_address_description+0x30/0x2d8 kasan_report+0x158/0x198 __asan_report_load4_noabort+0x44/0x50 regcache_flat_read+0x10c/0x110 regcache_read+0xf4/0x180 _regmap_read+0xc4/0x278 _regmap_update_bits+0x130/0x290 regmap_update_bits_base+0xc0/0x15c snd_soc_component_update_bits+0xa8/0x22c snd_soc_component_write_field+0x68/0xd4 tx_macro_digital_mute+0xec/0x140 Actually There is no need to have decimator with 32 bytes. By limiting the variable with short type u8 issue is resolved. Signed-off-by: visr --- sound/soc/codecs/lpass-tx-macro.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-= macro.c index bf27bdd5be20..73014fa6e4b8 100644 --- a/sound/soc/codecs/lpass-tx-macro.c +++ b/sound/soc/codecs/lpass-tx-macro.c @@ -242,7 +242,7 @@ enum { =20 struct tx_mute_work { struct tx_macro *tx; - u32 decimator; + u8 decimator; struct delayed_work dwork; }; =20 @@ -635,7 +635,7 @@ static int tx_macro_mclk_enable(struct tx_macro *tx, return 0; } =20 -static bool is_amic_enabled(struct snd_soc_component *component, int decim= ator) +static bool is_amic_enabled(struct snd_soc_component *component, u8 decima= tor) { u16 adc_mux_reg, adc_reg, adc_n; =20 @@ -849,7 +849,7 @@ static int tx_macro_enable_dec(struct snd_soc_dapm_widg= et *w, struct snd_kcontrol *kcontrol, int event) { struct snd_soc_component *component =3D snd_soc_dapm_to_component(w->dapm= ); - unsigned int decimator; + u8 decimator; u16 tx_vol_ctl_reg, dec_cfg_reg, hpf_gate_reg, tx_gain_ctl_reg; u8 hpf_cut_off_freq; int hpf_delay =3D TX_MACRO_DMIC_HPF_DELAY_MS; @@ -1064,9 +1064,10 @@ static int tx_macro_hw_params(struct snd_pcm_substre= am *substream, struct snd_soc_dai *dai) { struct snd_soc_component *component =3D dai->component; - u32 decimator, sample_rate; + u32 sample_rate; int tx_fs_rate; struct tx_macro *tx =3D snd_soc_component_get_drvdata(component); + u8 decimator =3D 0; =20 sample_rate =3D params_rate(params); switch (sample_rate) { @@ -1128,7 +1129,7 @@ static int tx_macro_digital_mute(struct snd_soc_dai *= dai, int mute, int stream) { struct snd_soc_component *component =3D dai->component; struct tx_macro *tx =3D snd_soc_component_get_drvdata(component); - u16 decimator; + u8 decimator; =20 /* active decimator not set yet */ if (tx->active_decimator[dai->id] =3D=3D -1) --=20 2.17.1