From nobody Thu Apr 9 18:49:26 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E60BC38F95F for ; Fri, 6 Mar 2026 12:22:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772799742; cv=none; b=tfYRgVpHCDnwHOuXIo4PrJfNjS7Z69JD+EYMCXXOtyV8sf1ENdmWkZ5L40aN722f3opY0pHnD1mNH23LYw2cr08aimHlxwmSo/H4G2hpX8QXyGyIIG/NH4RYWtn0uBrIv9UYwSmjNU1wlmt2sBuaYhFw3WRBaLFcdu7iOUt7tRc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772799742; c=relaxed/simple; bh=sljgOhpaU8wHMtLfJBiR4fUV3hNt3/HmvH6kZPwy9as=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pHyE4yBz4l/bcXE6f1jilYf83qHM/QP24kVFfqAY8prozyi+yqpdRgW94pmiTHEsvEsheHuNrFDdJ+PgZuclAk+TkXrf8kiBLqepbtcDrOthDohmVLTc4hFbodOZZWrFfDAy3XLnbZjlgnbK2Qvb/QCJdziH9qHKWckgmFSK3xY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=M8aKK6/Y; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=kezEdVVZ; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="M8aKK6/Y"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="kezEdVVZ" Received: from pps.filterd (m0279870.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 626BauSQ864945 for ; Fri, 6 Mar 2026 12:22:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=79Hssidv5J9 yhS1Hc5RwtLaxh/YVdwsl6nwkjjN6Bow=; b=M8aKK6/YM+T+Yq/STX4au9lSml/ 0yZRAh5L+EUHlUqbf0Byg+i8n5tElz3k4BibRqYcxV85ORR0rK0/Yt9HIgPvyF1U zhVfzWZgF+b5h+URskJm+u/0qKTLhV+nItkMLwZQJ+yQ5oLW+nM4QRIynu7pi41S AEEB3nf6rn1UvB/vq9aKvzwyF4RJKpJKxjFtyB9Cc9VZs/P6qW0BIhroZwlbITjC B/KziA+l42IFclh1VbnszhtkU8N4Hr+j3Gn8E/9Ubp8ih742m3Szb35/DfXBpVNr GcSkmD8Bimq9awTII0OxJYYBcKDqs0vS84Vn1y97Y1FyyQd59c4D2d5gFDw== Received: from mail-qk1-f198.google.com (mail-qk1-f198.google.com [209.85.222.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4cqrf5sc7s-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 06 Mar 2026 12:22:12 +0000 (GMT) Received: by mail-qk1-f198.google.com with SMTP id af79cd13be357-8cb42f56c4aso5315789885a.3 for ; Fri, 06 Mar 2026 04:22:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1772799732; x=1773404532; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=79Hssidv5J9yhS1Hc5RwtLaxh/YVdwsl6nwkjjN6Bow=; b=kezEdVVZ2Tl5Fil7UPcvBqE1olnSlaNN6Sr1tc9/uZ6K+8cNRKb8L+y8P1IOql7ci2 r8EhP96o6jroW1+dbOlpDYJpgQyPNx72w+SJp3Ez8MqfEuPJbu10gsZwr3nSdLh4qPf8 hc03Q5/FJQY6tIPHjcSEsSeVjOowwLNhj/E5l96XDtzUjyULiZNQFJ74odTGdiwvAdwF BP9X+CgCiZmkVibxg9Z5EPJkAQiG81CQXsH2vSOUqdCmqQ5f2eMBejw7ofnOhdufI/Db iXKyMlRfXDRykY5YVeag7dnrkKKx2XJPsBA6ZWt8D/9wRV46gcnawpH6BsbAa+NztNnu fReA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772799732; x=1773404532; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=79Hssidv5J9yhS1Hc5RwtLaxh/YVdwsl6nwkjjN6Bow=; b=aOms8YXTlSh/H2yNbbHGsLrwvhqqiFwi4XvXxJ6q0tVNi/htWwX18eAJAzO21ZqZ5V MqHzZL+bmoXN1XKevGlfWztsy7tm6P6XJV/ZXRPjkRk36hJAFM46cybsMp/we0LXqe9h pu8x4cmOpKFHnVOsFoT3+C05zdp5gyN9WodkHo2uJtx8mFAybdkqJ1Ky44uf4X7j/aVL TZBp4RQxNcu6c3W7MhVxrUvgG8jWCE0MRiKzo6Qk0CiooiCk9iSNbXtxgaPhVM8+cHSE UkniedTfkhOnOqmymyXkpSHMKQhpoAnItyugnukLxwTHHIpB+LQKtN5iTJKLd84pSYzQ 7Y0g== X-Forwarded-Encrypted: i=1; AJvYcCWQplFsYIPCbR6+mY8CZL7fqCAA4Mr+O25Z0TF73BrIdZgm57K2cFN+/I0iKVpfEwzHYdF0j57nv+LdAmA=@vger.kernel.org X-Gm-Message-State: AOJu0Yy4NoBlBeyE2w8amoSQBqqv0DLMgBSPyTD4gSzhSxvHnScuBF7Q XHE1PXyqNFCawUuInj9I2mCMM/Y7gjFILMXH/7qtHQL5smnxbB+wR8NHrNj3y6Zteuj/lWbcNdf 4pxTfVbSNw5OYDlvnnp7Nz3gBncViejwfG9v7mLYw8Q/1xVGAb7KZIeL4j7zzuQLQcws= X-Gm-Gg: ATEYQzwf+4l6II5oAAX9iyTcCz+7+WZEve4k6VQ4IVqGeqHTfIlDvTnvXhSJc1Ac+Gh 8nVbFIdgUzXDys05I20k6rJRzDl5m/6yFUKCHeE0nAJV+OTHCEhSftBI9RN9PydevXoaYD/fDBS sYVJosjbHxSJ4xDOwfEwifFA1F1BASeGpEWygoTDpSAyxUUsKzGnpvRE/CRZA00J86G5nbo+hXn ENfslVnECoiCX/REnZlZfX+x1fEOzFqfhbjx/0m4cbBqj+LI1Zr2EgLyd8F/3bC6ToNbmWDQSLG ASstDXTM1njl0vhSWOOZWff5BQmRxF+x/B7QfXBxrRN8oqqfFXFDExvAu8qjn3muqth9Mj8N37N pqAbWfgVXXQ2cs6C6gRnGulzKXAZOI1JPSN5rosuioGC1X1BxwzvdY4Y= X-Received: by 2002:a05:620a:711a:b0:8c6:ab8b:29e3 with SMTP id af79cd13be357-8cd6d4a5208mr228839485a.44.1772799731934; Fri, 06 Mar 2026 04:22:11 -0800 (PST) X-Received: by 2002:a05:620a:711a:b0:8c6:ab8b:29e3 with SMTP id af79cd13be357-8cd6d4a5208mr228836185a.44.1772799731366; Fri, 06 Mar 2026 04:22:11 -0800 (PST) Received: from localhost.localdomain ([5.133.47.210]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4851fa87e56sm111972395e9.0.2026.03.06.04.22.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Mar 2026 04:22:10 -0800 (PST) From: Srinivas Kandagatla To: broonie@kernel.org, robh@kernel.org, krzk+dt@kernel.org, conor+dt@kernel.org Cc: mohammad.rafi.shaik@oss.qualcomm.com, linux-sound@vger.kernel.org, lgirdwood@gmail.com, perex@perex.cz, tiwai@suse.com, johan@kernel.org, dmitry.baryshkov@oss.qualcomm.com, konrad.dybcio@oss.qualcomm.com, linux-arm-msm@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, mailingradian@gmail.com, Srinivas Kandagatla Subject: [PATCH v4 09/13] ASoC: qcom: common: validate cpu dai id during parsing Date: Fri, 6 Mar 2026 12:21:11 +0000 Message-ID: <20260306122115.509705-10-srinivas.kandagatla@oss.qualcomm.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260306122115.509705-1-srinivas.kandagatla@oss.qualcomm.com> References: <20260306122115.509705-1-srinivas.kandagatla@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-ORIG-GUID: ULvHHFgUDpR6o_y6jD8PbMQuz8NlAR7D X-Proofpoint-GUID: ULvHHFgUDpR6o_y6jD8PbMQuz8NlAR7D X-Authority-Analysis: v=2.4 cv=L+oQguT8 c=1 sm=1 tr=0 ts=69aac6f4 cx=c_pps a=qKBjSQ1v91RyAK45QCPf5w==:117 a=ZsC4DHZuhs/kKio7QBcDoQ==:17 a=Yq5XynenixoA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=gowsoOTTUOVcmtlkKump:22 a=EUspDBNiAAAA:8 a=FTFSxu1yF2iZ1NjiFwcA:9 a=NFOGd7dJGGMPyQGDc5-O:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzA2MDExNyBTYWx0ZWRfX1O1P/dVfYwTA WINlJUUyRHnrnLyTqTrmunT1aaJkWVPgsnrYg+LPjGbM+MFdPOy7BnHVw0SII/GjUqaLknjnHlD zaICplY4vX7upfJuNIqj081pCup5vtqOrULduA/4k6W17C4LeW46ac3Imjk0Pz5XwU/Zjx7llJ4 wM7MGf7TcpC9Yqv0zQjyyFwvkB3BcvAv+HtUuOnLYq+vHnujz7ZYab8XkyBHmfE4rkMzlPEM5zQ au6gNcgFJw38Y2vjLx9UedLh+02jreCPhgv2FxjKC698wC+taFxTqrtp4iThOxeB+uobJlIReYC AFZae87yTfG3Mw6FKdb8ocg6Mhmx/kQRKCI3emPZsOFPF4Vbt5WRnZgco/Qk+0XUbD4o/fF2UyW sJAUvFT+4/ABYrKlYeUtwuM01XmkZU6D60wUySyjXhY91QZe3rxSVTlFLhGylxYBk4klBMu6paH yR2FKzo5v7rpJRk4DiQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-06_04,2026-03-06_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 suspectscore=0 adultscore=0 bulkscore=0 priorityscore=1501 phishscore=0 impostorscore=0 lowpriorityscore=0 spamscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2602130000 definitions=main-2603060117 Content-Type: text/plain; charset="utf-8" lpass ports numbers have been added but the afe/apm driver never got updated with new max port value that it uses to store dai specific data. There are more than one places these values are cached and always become out of sync. This will result in array out of bounds and weird driver behaviour. To catch such issues, first add a single place where we can define max port and second add a check in common parsing code which can error out before corrupting the memory with out of bounds array access. This should help both avoid and catch these type of mistakes in future. Signed-off-by: Srinivas Kandagatla --- sound/soc/qcom/common.c | 6 ++++++ sound/soc/qcom/common.h | 3 +++ sound/soc/qcom/lpass.h | 3 ++- sound/soc/qcom/qdsp6/q6afe.h | 3 ++- sound/soc/qcom/qdsp6/q6apm.h | 3 ++- 5 files changed, 15 insertions(+), 3 deletions(-) diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c index 7ee60a58a336..878b42babcc3 100644 --- a/sound/soc/qcom/common.c +++ b/sound/soc/qcom/common.c @@ -120,6 +120,12 @@ int qcom_snd_parse_of(struct snd_soc_card *card) =20 link->id =3D args.args[0]; =20 + if (link->id > LPASS_MAX_PORT) { + dev_err(dev, "%s: Invalid cpu dai id %d\n", link->name, link->id); + ret =3D -EINVAL; + goto err; + } + if (platform) { link->platforms->of_node =3D of_parse_phandle(platform, "sound-dai", diff --git a/sound/soc/qcom/common.h b/sound/soc/qcom/common.h index 1b8d3f90bffa..ee6662885593 100644 --- a/sound/soc/qcom/common.h +++ b/sound/soc/qcom/common.h @@ -4,8 +4,11 @@ #ifndef __QCOM_SND_COMMON_H__ #define __QCOM_SND_COMMON_H__ =20 +#include #include =20 +#define LPASS_MAX_PORT (SENARY_MI2S_TX + 1) + int qcom_snd_parse_of(struct snd_soc_card *card); int qcom_snd_wcd_jack_setup(struct snd_soc_pcm_runtime *rtd, struct snd_soc_jack *jack, bool *jack_setup); diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h index de3ec6f594c1..68b71039b981 100644 --- a/sound/soc/qcom/lpass.h +++ b/sound/soc/qcom/lpass.h @@ -14,10 +14,11 @@ #include #include #include +#include "common.h" #include "lpass-hdmi.h" =20 #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000 -#define LPASS_MAX_PORTS (DISPLAY_PORT_RX_7 + 1) +#define LPASS_MAX_PORTS (LPASS_MAX_PORT) #define LPASS_MAX_MI2S_PORTS (8) #define LPASS_MAX_DMA_CHANNELS (8) #define LPASS_MAX_HDMI_DMA_CHANNELS (4) diff --git a/sound/soc/qcom/qdsp6/q6afe.h b/sound/soc/qcom/qdsp6/q6afe.h index a29abe4ce436..0b8c3ec1315c 100644 --- a/sound/soc/qcom/qdsp6/q6afe.h +++ b/sound/soc/qcom/qdsp6/q6afe.h @@ -2,8 +2,9 @@ =20 #ifndef __Q6AFE_H__ #define __Q6AFE_H__ +#include "../common.h" =20 -#define AFE_PORT_MAX 137 +#define AFE_PORT_MAX (LPASS_MAX_PORT) =20 #define MSM_AFE_PORT_TYPE_RX 0 #define MSM_AFE_PORT_TYPE_TX 1 diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h index 7ce08b401e31..5cf538397841 100644 --- a/sound/soc/qcom/qdsp6/q6apm.h +++ b/sound/soc/qcom/qdsp6/q6apm.h @@ -14,9 +14,10 @@ #include #include #include +#include "../common.h" #include "audioreach.h" =20 -#define APM_PORT_MAX 127 +#define APM_PORT_MAX LPASS_MAX_PORT #define APM_PORT_MAX_AUDIO_CHAN_CNT 8 #define PCM_CHANNEL_NULL 0 #define PCM_CHANNEL_FL 1 /* Front left channel. */ --=20 2.47.3