From nobody Wed Apr 15 16:26:16 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DB6639B946 for ; Wed, 4 Mar 2026 13:07:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772629660; cv=none; b=fidrbi01BvRvNOJvYtjDIsNFcKhge+3tKw50jIoGkalGUhFG5x/6ensV/xLepI3ahpq6bNzBBo5xRQ4Q8vwq7HgbmwClDvIKozSkEyRqc6L69yf0rwSFGIll6mNANEs2wNqGAOhnAgv/s8vJDnP5taUwxoOT2IUWcaltLPYS6Ng= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772629660; c=relaxed/simple; bh=sljgOhpaU8wHMtLfJBiR4fUV3hNt3/HmvH6kZPwy9as=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=crQrCvVqo09zcw6Kmd7OfvCMcqXmesbsMfos0WKRBADQNcDq2BICjzVqwbhwEWJ5JK1CFt63CfBIDQQZEKdmMOLDrp73BFjvqVfOb1SdOrIw6yV8APXE+ob1YhFjBZ1jDNAeMHhhJprI+RNotnekFr5AwD2VFXeSRfYvbO6rYRs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=hTwiyvl3; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=Jpd3WMkd; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="hTwiyvl3"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="Jpd3WMkd" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6249KuE31456217 for ; Wed, 4 Mar 2026 13:07:36 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=79Hssidv5J9 yhS1Hc5RwtLaxh/YVdwsl6nwkjjN6Bow=; b=hTwiyvl31OaC7ApzylVMWQsVubV 4U6Z/UUXpDl3dlYAyeX8nkLZ1MWamba3PIqec9PNZrFX5gOgns3kfstv0zqNYS2N C+OS+Ucb09yIWW0ZtyDMe6ZO4lmwZevL0NNhw3FN88M4tjfb1tqY2/IiQ0JVCMKy lxJcz3XAGhATaNOtLGkvVn/CJIpLkHcTRKu7aNy7g7vg289pk6k3rxUGbGL9SYxj 2t45hNWNB9+OZw2b7U7JyYCrtYI9FsSABfOHz31+rA2l7JisWyfXtiHFcTcRhuH5 8rPJCFq4FFRJWDkIOVRzyZRSgCpVJMSFJUAFNZrc2ugmAQm7zGseXVKvbYA== Received: from mail-qk1-f198.google.com (mail-qk1-f198.google.com [209.85.222.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4cpj180n4e-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 04 Mar 2026 13:07:35 +0000 (GMT) Received: by mail-qk1-f198.google.com with SMTP id af79cd13be357-8cb4d191ef1so880745985a.0 for ; Wed, 04 Mar 2026 05:07:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1772629655; x=1773234455; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=79Hssidv5J9yhS1Hc5RwtLaxh/YVdwsl6nwkjjN6Bow=; b=Jpd3WMkduXYW4/kARlwwIesKU76kTV2Ie7n9E39INm5Sf6w4sSAD9akqv/212DysJL VvWgMBmYXhpfBSA+FpRHN0eQYyMs12QIO++tlRFLAiswdeDZc0Zypr3CXU4CyuA5tKXA PGToI0j6HK4sEcW34hmMqc0CQ4P4T6E3ZX0rq/04ENOo4NbYtyI3LGcXXHph7MwC9jr7 1/hV2OUR1eprH+Q1tNL0dTGvU/vfncpL2vVxexadWIOJicLaU5W+vQIOAs0EDUXYFnBi ezcNGMPZR3E6fQghQx/DpSvJJYfEdjpx1yLH4r7k0IY0kdiQrajr5c2ert7w7HaLldQA d3zg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772629655; x=1773234455; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=79Hssidv5J9yhS1Hc5RwtLaxh/YVdwsl6nwkjjN6Bow=; b=t1xJDOO3zIQ4DMKvN4lK+ITEUuT/gT4OWfhoXbIaA852Gg+kT/G3Ixjf5KE9eSzq03 s9r6x88hNczZjCjfnExTQA2hYh+ntSHpblJZDX3PTuwgZ2h4pILbYwUClqygo79GICwI OYZZOFbQR/Ls8e3+38+LAxYOghFYD1meRzUNWCY4FWIBiBAQNmWiZg9s31uDrHUYlI90 7TZhYpPpGTawphfM/y48G0VKWopkyay40gIGC1uHts36qGzGiFHZTe56mo1CzzYF+I2l ZzW1xQjpDJ9k/Dr6ELFL/m+NXGZ+dzdjNgHLy2hfHtWxvMdSZVJCDLy7s9ix3IFyK6xI TFqg== X-Forwarded-Encrypted: i=1; AJvYcCU86d+lBkIL+JJ4PHIjfGUgBjfiPDKmwXaW1e5kG+RnPDsh98eWMa9hAGEmCT+YULrPffR+mLu9XvCupd0=@vger.kernel.org X-Gm-Message-State: AOJu0Yz+BnhwRaiqODC9d6ANWTs1X4j/eKZilTcGcjJMH1L6IkRE+jIQ F1yAcDAjTHSBf0JuD+hoJaQ8VgKgUv3q2VH4a5YHnkUiiI0GeyaKBuONo1961JI14GFYHdbnKFS rdh3ApEbUQBGrps/8y4/Ne9MENTXEWsWA9GcBg1npivYrDUgk3y67BtCLQhgg59aM2dA= X-Gm-Gg: ATEYQzy+GKcTTvlPjiR3e7aaC5/HiVyRfXTr/LyUpLAWEvRjvfLlbthzgJ/4OMZ50l5 Tnmluuo437jH2SqfjW3DVsvvoxVZLu2UzHk0Jd3RMH9xme0ECIwQK9JqCTzGyf8qEEjl+fEmm6h gmxTOELJx/eNRWFDzvWsVYSIFYVAaDAjXDq5DgGJ+7BwZjupf2mgTmo8rPJU/cYh30OfukAJgt7 j49Ix5m9s4qKZR8vz8PCvGOEF/HsMaCk4Atk/5qTK1/mbeKN6pE3b9AGT6WWeIt7yOx9Ca+fGzk ZmMfbbI6lQA85j9clh5iKHAndCvs8cfeh9T984eRyI4nqjpK+Wu9J/O9TIdJZMdsdHPago9RBy6 bS2U3qe+3QP5Rl5elujA5WLVQoa+rApli8o33N3c1lCElxQIbEB+IpSU= X-Received: by 2002:a05:620a:290d:b0:8c5:38c3:7cca with SMTP id af79cd13be357-8cd5af0dd89mr216126585a.31.1772629651985; Wed, 04 Mar 2026 05:07:31 -0800 (PST) X-Received: by 2002:a05:620a:290d:b0:8c5:38c3:7cca with SMTP id af79cd13be357-8cd5af0dd89mr216096085a.31.1772629648720; Wed, 04 Mar 2026 05:07:28 -0800 (PST) Received: from localhost.localdomain ([5.133.47.210]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485188122a6sm49969745e9.12.2026.03.04.05.07.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Mar 2026 05:07:28 -0800 (PST) From: Srinivas Kandagatla To: broonie@kernel.org, robh@kernel.org, krzk+dt@kernel.org, conor+dt@kernel.org Cc: mohammad.rafi.shaik@oss.qualcomm.com, linux-sound@vger.kernel.org, lgirdwood@gmail.com, perex@perex.cz, tiwai@suse.com, johan@kernel.org, dmitry.baryshkov@oss.qualcomm.com, konrad.dybcio@oss.qualcomm.com, linux-arm-msm@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, srini@kernel.org, Srinivas Kandagatla Subject: [PATCH v3 10/14] ASoC: qcom: common: validate cpu dai id during parsing Date: Wed, 4 Mar 2026 13:07:08 +0000 Message-ID: <20260304130712.222246-11-srinivas.kandagatla@oss.qualcomm.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260304130712.222246-1-srinivas.kandagatla@oss.qualcomm.com> References: <20260304130712.222246-1-srinivas.kandagatla@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: tJaJK-IJUbvcMMAXmM4t3t8QWmHCtwck X-Proofpoint-ORIG-GUID: tJaJK-IJUbvcMMAXmM4t3t8QWmHCtwck X-Authority-Analysis: v=2.4 cv=Ed7FgfmC c=1 sm=1 tr=0 ts=69a82e97 cx=c_pps a=qKBjSQ1v91RyAK45QCPf5w==:117 a=ZsC4DHZuhs/kKio7QBcDoQ==:17 a=Yq5XynenixoA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=EUspDBNiAAAA:8 a=FTFSxu1yF2iZ1NjiFwcA:9 a=NFOGd7dJGGMPyQGDc5-O:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzA0MDEwNSBTYWx0ZWRfX9zRtDNylZnkj jGo6aoCCT1MDdkwGCiei3HDkDWTKXnEY+45Q5ekv6mvemXUsl54USe565asO+Vy7tTo1N4WoYrp ipEdZ4SS9pjkJiPVrpdvflBw59Ja5bNa8jJHC7T10vjsIhvSKC61ZwBeZKPANhl4sErw4LBEur/ ZmZ6oIHsq9jncHmCcT28SBR/hieJg22b3nJLTYRjIrVAIhxHFvYomShw8AKv5IT+aq4nCt1ARqs KaG/swZFdsc+zVQu0AmTVvyw7b1g2M4p2sS3ZBPKgtC/z79nZWO9CcJoBCr5qwlNinLNXwx9WKi o7YQ+EVjt3TDOdDrVYZweP1sJv7QE7KgXy8Sbl+aTlQEW5UOIuLbQmoZE35CBWaX7qjOPsPAslM OpiWziFPQ3E5ChOPFsZGFHd5U3EzBYyoJpKfJ75ZJ7z9/Wdd7yirMCTi+Ys1w2n23zglt9DpIaT AkFqKXUjOOrEhtlWBxA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-04_06,2026-03-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 suspectscore=0 spamscore=0 adultscore=0 lowpriorityscore=0 clxscore=1015 malwarescore=0 impostorscore=0 priorityscore=1501 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2602130000 definitions=main-2603040105 Content-Type: text/plain; charset="utf-8" lpass ports numbers have been added but the afe/apm driver never got updated with new max port value that it uses to store dai specific data. There are more than one places these values are cached and always become out of sync. This will result in array out of bounds and weird driver behaviour. To catch such issues, first add a single place where we can define max port and second add a check in common parsing code which can error out before corrupting the memory with out of bounds array access. This should help both avoid and catch these type of mistakes in future. Signed-off-by: Srinivas Kandagatla --- sound/soc/qcom/common.c | 6 ++++++ sound/soc/qcom/common.h | 3 +++ sound/soc/qcom/lpass.h | 3 ++- sound/soc/qcom/qdsp6/q6afe.h | 3 ++- sound/soc/qcom/qdsp6/q6apm.h | 3 ++- 5 files changed, 15 insertions(+), 3 deletions(-) diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c index 7ee60a58a336..878b42babcc3 100644 --- a/sound/soc/qcom/common.c +++ b/sound/soc/qcom/common.c @@ -120,6 +120,12 @@ int qcom_snd_parse_of(struct snd_soc_card *card) =20 link->id =3D args.args[0]; =20 + if (link->id > LPASS_MAX_PORT) { + dev_err(dev, "%s: Invalid cpu dai id %d\n", link->name, link->id); + ret =3D -EINVAL; + goto err; + } + if (platform) { link->platforms->of_node =3D of_parse_phandle(platform, "sound-dai", diff --git a/sound/soc/qcom/common.h b/sound/soc/qcom/common.h index 1b8d3f90bffa..ee6662885593 100644 --- a/sound/soc/qcom/common.h +++ b/sound/soc/qcom/common.h @@ -4,8 +4,11 @@ #ifndef __QCOM_SND_COMMON_H__ #define __QCOM_SND_COMMON_H__ =20 +#include #include =20 +#define LPASS_MAX_PORT (SENARY_MI2S_TX + 1) + int qcom_snd_parse_of(struct snd_soc_card *card); int qcom_snd_wcd_jack_setup(struct snd_soc_pcm_runtime *rtd, struct snd_soc_jack *jack, bool *jack_setup); diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h index de3ec6f594c1..68b71039b981 100644 --- a/sound/soc/qcom/lpass.h +++ b/sound/soc/qcom/lpass.h @@ -14,10 +14,11 @@ #include #include #include +#include "common.h" #include "lpass-hdmi.h" =20 #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000 -#define LPASS_MAX_PORTS (DISPLAY_PORT_RX_7 + 1) +#define LPASS_MAX_PORTS (LPASS_MAX_PORT) #define LPASS_MAX_MI2S_PORTS (8) #define LPASS_MAX_DMA_CHANNELS (8) #define LPASS_MAX_HDMI_DMA_CHANNELS (4) diff --git a/sound/soc/qcom/qdsp6/q6afe.h b/sound/soc/qcom/qdsp6/q6afe.h index a29abe4ce436..0b8c3ec1315c 100644 --- a/sound/soc/qcom/qdsp6/q6afe.h +++ b/sound/soc/qcom/qdsp6/q6afe.h @@ -2,8 +2,9 @@ =20 #ifndef __Q6AFE_H__ #define __Q6AFE_H__ +#include "../common.h" =20 -#define AFE_PORT_MAX 137 +#define AFE_PORT_MAX (LPASS_MAX_PORT) =20 #define MSM_AFE_PORT_TYPE_RX 0 #define MSM_AFE_PORT_TYPE_TX 1 diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h index 7ce08b401e31..5cf538397841 100644 --- a/sound/soc/qcom/qdsp6/q6apm.h +++ b/sound/soc/qcom/qdsp6/q6apm.h @@ -14,9 +14,10 @@ #include #include #include +#include "../common.h" #include "audioreach.h" =20 -#define APM_PORT_MAX 127 +#define APM_PORT_MAX LPASS_MAX_PORT #define APM_PORT_MAX_AUDIO_CHAN_CNT 8 #define PCM_CHANNEL_NULL 0 #define PCM_CHANNEL_FL 1 /* Front left channel. */ --=20 2.47.3