1. Patchew
  2. linux
  3. View series

[PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

Harshit Mogalapalli posted 1 patch 4 weeks ago 
drivers/soundwire/bus_type.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[PATCH] soundwire: bus: fix off-by-one when allocating slave IDs
Posted by Harshit Mogalapalli 4 weeks ago 
ida_alloc_max() interprets its max argument as inclusive.

Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
allocated, but the IRQ domain created for the bus is sized for IDs
0-15.  If 16 is returned, irq_create_mapping() fails and the driver
ends up with an invalid IRQ mapping.

Limit the allocation to 0-15 by passing SDW_FW_MAX_DEVICES - 1.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202512240450.hlDH3nCs-lkp@intel.com/
Fixes: aab12022b076 ("soundwire: bus: Add internal slave ID and use for IRQs")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
---
Only compile tested.
---
 drivers/soundwire/bus_type.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soundwire/bus_type.c b/drivers/soundwire/bus_type.c
index 80ed3468e860..a05aa36828cb 100644
--- a/drivers/soundwire/bus_type.c
+++ b/drivers/soundwire/bus_type.c
@@ -99,7 +99,7 @@ static int sdw_bus_probe(struct device *dev)
 	if (ret)
 		return ret;
 
-	ret = ida_alloc_max(&slave->bus->slave_ida, SDW_FW_MAX_DEVICES, GFP_KERNEL);
+	ret = ida_alloc_max(&slave->bus->slave_ida, SDW_FW_MAX_DEVICES - 1, GFP_KERNEL);
 	if (ret < 0) {
 		dev_err(dev, "Failed to allocated ID: %d\n", ret);
 		return ret;
-- 
2.47.3
Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs
Posted by Vinod Koul 3 weeks, 5 days ago 
On Sat, 10 Jan 2026 12:19:58 -0800, Harshit Mogalapalli wrote:
> ida_alloc_max() interprets its max argument as inclusive.
> 
> Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> allocated, but the IRQ domain created for the bus is sized for IDs
> 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> ends up with an invalid IRQ mapping.
> 
> [...]

Applied, thanks!

[1/1] soundwire: bus: fix off-by-one when allocating slave IDs
      commit: 12d4fd9a657174496677cff2841315090f1c11fc

Best regards,
-- 
~Vinod
Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs
Posted by Charles Keepax 3 weeks, 6 days ago 
On Sat, Jan 10, 2026 at 12:19:58PM -0800, Harshit Mogalapalli wrote:
> ida_alloc_max() interprets its max argument as inclusive.
> 
> Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> allocated, but the IRQ domain created for the bus is sized for IDs
> 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> ends up with an invalid IRQ mapping.
> 
> Limit the allocation to 0-15 by passing SDW_FW_MAX_DEVICES - 1.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/r/202512240450.hlDH3nCs-lkp@intel.com/
> Fixes: aab12022b076 ("soundwire: bus: Add internal slave ID and use for IRQs")
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
> ---

Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>

Thanks,
Charles
Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs
Posted by Markus Elfring 4 weeks ago 
…
> Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> allocated, but the IRQ domain created for the bus is sized for IDs
> 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> ends up with an invalid IRQ mapping.
…

See also once more:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc4#n659

Regards,
Markus
Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs
Posted by Dan Carpenter 3 weeks, 6 days ago 
On Sun, Jan 11, 2026 at 10:27:08AM +0100, Markus Elfring wrote:
> …
> > Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> > allocated, but the IRQ domain created for the bus is sized for IDs
> > 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> > ends up with an invalid IRQ mapping.
> …
> 
> See also once more:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc4#n659
> 

Markus, please only comment when it's a bug in the patch instead of
wrong advice about commit messages.

regards,
dan carpenter
Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs
Posted by Dan Carpenter 3 weeks, 6 days ago 
On Mon, Jan 12, 2026 at 11:26:51AM +0300, Dan Carpenter wrote:
> On Sun, Jan 11, 2026 at 10:27:08AM +0100, Markus Elfring wrote:
> > …
> > > Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> > > allocated, but the IRQ domain created for the bus is sized for IDs
> > > 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> > > ends up with an invalid IRQ mapping.
> > …
> > 
> > See also once more:
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc4#n659
> > 
> 
> Markus, please only comment when it's a bug in the patch instead of
> wrong advice about commit messages.

Sorry, if that was unclear.  The link is a real link to the documentation
which says:

  - The body of the explanation, line wrapped at 75 columns, which will
    be copied to the permanent changelog to describe this patch.

The rules that we write down are simplified guidelines which are designed
to be easy explain.  75 is the upper bound where checkpatch will complain.
But I think line wrapping at 72 or 74 characters is more common.  Either
way it's fine.

regards,
dan carpenter
Re: soundwire: bus: fix off-by-one when allocating slave IDs
Posted by Markus Elfring 3 weeks, 6 days ago 
> Sorry, if that was unclear.  The link is a real link to the documentation
> which says:
> 
>   - The body of the explanation, line wrapped at 75 columns, which will
>     be copied to the permanent changelog to describe this patch.
> 
> The rules that we write down are simplified guidelines which are designed
> to be easy explain.  75 is the upper bound where checkpatch will complain.
…

Can we benefit a bit more from this system configuration setting
instead of performing word wrapping at around the column 67 here?

Regards,
Markus
Re: soundwire: bus: fix off-by-one when allocating slave IDs
Posted by Richard Fitzgerald 3 weeks, 6 days ago 
On 12/01/2026 10:55 am, Markus Elfring wrote:
>> Sorry, if that was unclear.  The link is a real link to the documentation
>> which says:
>>
>>    - The body of the explanation, line wrapped at 75 columns, which will
>>      be copied to the permanent changelog to describe this patch.
>>
>> The rules that we write down are simplified guidelines which are designed
>> to be easy explain.  75 is the upper bound where checkpatch will complain.
> …
> 
> Can we benefit a bit more from this system configuration setting
Why is this wrapped at column 64?

> instead of performing word wrapping at around the column 67 here?
> 
> Regards,
> Markus
>
Re: soundwire: bus: fix off-by-one when allocating slave IDs
Posted by Vinod Koul 3 weeks, 5 days ago 
On 12-01-26, 11:13, Richard Fitzgerald wrote:
> On 12/01/2026 10:55 am, Markus Elfring wrote:
> > > Sorry, if that was unclear.  The link is a real link to the documentation
> > > which says:
> > > 
> > >    - The body of the explanation, line wrapped at 75 columns, which will
> > >      be copied to the permanent changelog to describe this patch.
> > > 
> > > The rules that we write down are simplified guidelines which are designed
> > > to be easy explain.  75 is the upper bound where checkpatch will complain.
> > …
> > 
> > Can we benefit a bit more from this system configuration setting
> Why is this wrapped at column 64?

Good one :-)

I have a tendency to not look into a lot of things our friend is asking
for, seems to be not worth your time!

-- 
~Vinod

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.