From nobody Thu Apr 9 13:33:12 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A5D3366053 for ; Mon, 9 Mar 2026 06:51:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773039117; cv=none; b=GAZtoIb5T5Uby57OaOWrdit906RZqHx/uR0GMvg4KD/TOYqj0iWvk51rqFkqxmlJ/6+VZzd22pi5AglP24RgPv5PlLQTFDRDc/1snH4QqEUHHuVSUSFkdorHyy9sO60mVwin8V1rkLASyVDaH1RLr5Ak2rpFCJLzeEWGqwQxeDA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773039117; c=relaxed/simple; bh=CrLGv5edH+UZPIk9+prSCn/qT8iVjWiDSBnsGzRqcxE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=J+Wu28EMY5ADOG6/r9s9DsbwTHwszlzGGDrXkN4/sSwtJpkzmBT7NzudOeIJrepl2z3vvKeg0DmgqNV8XP+TtEQ4vo+AR6dIgjXqYrf/aFoEhRqr47VYOY86/bk2zw4fjADCzFOmYZAYifDVKdu7G+bT1crVBZXrXIjghb0UWxI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=XakMq7Bq; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=d5NszAVx; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="XakMq7Bq"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="d5NszAVx" Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 628MLfe42920471 for ; Mon, 9 Mar 2026 06:51:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=aiejSc4X5A/ gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=XakMq7BqCmC1gZPEOQ7zm7b79F/ 2VrsLN27za8MrpO7f83tVypuG/BBYQj8akbSGCXvfQH1VIjwe4cob2itf6hr52WV zZu4u0dNA5rcEs+x2i9O9sb9ezIrFqpkodyJnIZMJamSkkPvxz74053g5yNnT3lI qXkN5jmXGXe8huhPcn5vzAYNXWGmkZezB3UUrOwL8ZlLuhURXlVAuZgUZd6qCgOP gi+w82RKvz3tKKthOX8ZGRaQR2jqeGcnWEYf6W8Sohd1KYEx1EyF1JECk0HRoJ6W WkGMZzV2IiAqqRMz2vPtUZ8P47oPXaotjmh+slQ6HnrfGkvUf+j4gK7f1rg== Received: from mail-qk1-f197.google.com (mail-qk1-f197.google.com [209.85.222.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4cr9qevhsv-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 09 Mar 2026 06:51:55 +0000 (GMT) Received: by mail-qk1-f197.google.com with SMTP id af79cd13be357-8cd84943c76so583935685a.0 for ; Sun, 08 Mar 2026 23:51:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1773039114; x=1773643914; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=aiejSc4X5A/gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=d5NszAVxs0IWtEik9sP+g+EI9nwy64XB+7P0xnt4tTeaa8L27Ylq5votEIAAiqE2TA v1majHdpO8iKNRK3bvyU520F0iXebqSw3r8oNfXyUVd3AvbEnbq1vIJvnoojwV2eDTPO rggxyU7+9ww3Yi9a1pRMpwki/MRm1fwSIt/4jKNnPhQKP/0m4VIvDRwv0S2LsUmezle7 m9qTf8vVK6FBN+5AXNgqx4akqj3JI1wyMGkciTwdzAO8Aig8dw87dhEYWGIdV4lWsfkp mMzpOzmJJulXTeP8iQbBBUIGLwPX/ydjDOMpXULQEyje2iFdWjc7Q2g055Tq9fxtA2z0 4KQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773039114; x=1773643914; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=aiejSc4X5A/gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=xTHkf5LFrwZVnStQl/NirwrGTcdov1Uw26vPcLt09yiXD6TtYM7iyxiI8qCtkCdJxp VZK1KFXCROkhs6ObdZyrpZN5dwkk5t7S9B/B0oecg5WJz7lrIy/9nHX6PKoq9vWEHW5K 75+9NGajJWyazl1390SXmY92X4yzmn3NKkRXDi6gc0/Fqx2WRCYWlM0NEtkkh7eQOBVB GPYM18L3GLMvk9rGO0uGuOGbo3XCFKltImI2DOxg6aPvKrS2PX4WabVtRsY2pxdaPs8N ZAyuLR9Xj5ZcJ3cq4xwf/lFbW+e7nA9htCav/CEBYk5c2cZcVp2oxUojwkXMg2yiAHVC dSRA== X-Forwarded-Encrypted: i=1; AJvYcCWC7ikiThctL6RT0y0LscfOaSVGJEe2Xm42BeiIw0wDLEHlp+gKGJGDPuoy9grb9kjcb01FM30WvN9xlEA=@vger.kernel.org X-Gm-Message-State: AOJu0YyupuU4XPC9tOrIIGJ+Vp5jjLdVoXND14oBJLBcWcchI7lpP5Ln LhNhKD1nMMioQIvr7FdJ762MDmd9M7iz5WlEG6uxO9CT5FYtUaSMjh0mc2p5nUqxVVR79eVd94b vEEyDUqEdL+eqh5cwPEYXPhe+ktZ757UmsMdlOjWl7XBl2dvq4iBIaoDpC46/TuDYMwI= X-Gm-Gg: ATEYQzyI3h3KpvUYSeCs0He7SoTTZwswTO5E1gxFaf3EYcMHdJZ2XMATFv2E7ha+iP3 Q2AXOOjrCl5Mi/bP9nPCJLTeqXbXOTLl2Pv9O3xXR9BPYMV3eMZrYvweM6CwSdIoctODpdDFg+F 6sHUWH3l/Haa1WnMuayC7E+/RnminCmHk0JlVI1X8yTb4k0gsyy7m6P3p8VmMdoGQDUmKoZqudC 5WI0HhnrsQPTSLsFPKgNsns3JsocN6b3JrvKS4GCCf+vkY8QPibvqRsMj/3PgrVB01PG5kXLMVa hutQHcvedhrWoHCrEua0/QEzAT4ReFGgtquhovsAagb2xUPxvEK/0AuWucCqq+2DBTjJpqZ9Zw1 nYG+WUlnQPVRoaNQ+tbRbqkD6X5ukrullY5La5+acQhKjX4SEO43Dpys= X-Received: by 2002:a05:620a:4408:b0:8b2:e3c1:24b7 with SMTP id af79cd13be357-8cd634e8fe6mr1713297685a.29.1773039114491; Sun, 08 Mar 2026 23:51:54 -0700 (PDT) X-Received: by 2002:a05:620a:4408:b0:8b2:e3c1:24b7 with SMTP id af79cd13be357-8cd634e8fe6mr1713295285a.29.1773039113964; Sun, 08 Mar 2026 23:51:53 -0700 (PDT) Received: from localhost.localdomain ([5.133.47.210]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48529f01997sm80449975e9.14.2026.03.08.23.51.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Mar 2026 23:51:53 -0700 (PDT) From: Srinivas Kandagatla To: broonie@kernel.org, robh@kernel.org, krzk+dt@kernel.org, conor+dt@kernel.org Cc: mohammad.rafi.shaik@oss.qualcomm.com, linux-sound@vger.kernel.org, lgirdwood@gmail.com, perex@perex.cz, tiwai@suse.com, johan@kernel.org, dmitry.baryshkov@oss.qualcomm.com, konrad.dybcio@oss.qualcomm.com, linux-arm-msm@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, mailingradian@gmail.com, Srinivas Kandagatla Subject: [PATCH v5 09/13] ASoC: qcom: common: validate cpu dai id during parsing Date: Mon, 9 Mar 2026 06:51:33 +0000 Message-ID: <20260309065137.949053-10-srinivas.kandagatla@oss.qualcomm.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260309065137.949053-1-srinivas.kandagatla@oss.qualcomm.com> References: <20260309065137.949053-1-srinivas.kandagatla@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-ORIG-GUID: hfhzFIMGxNaaUCcyesiru4T-0oE5_XL6 X-Proofpoint-GUID: hfhzFIMGxNaaUCcyesiru4T-0oE5_XL6 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzA5MDA2MSBTYWx0ZWRfX6WSeD0qC6GJf EXGp1vsdzSV70i00fkK/vQ3N/kd+7XRYIHf6TtDM6IgSgnNH53xkhIQR4vdhk11OLdBxS4hlM3O e8Ogrl5mK1aZyU9hsnmsFt1IDZDVFWeNceWgWfIQDZw+uVxnqXGFZUoGuDlGew1gr5Q31lu56ME WnzQ0i+EjSd+FUZRjvVCVY1K+AYJIUYwA1jcWndU4rjqiwzBPoVUeF2rvPtp1afwo2BoB8R3t+W Q3fCtuEO828r65gzGCM9rtPfIqM2utXS+fTU8A6riuyLCKUFGDjy7vHH5c7BU4XlTWbcTnDNSBB lulenUlY+vqTM3dK9CtubGFj4RRfAkjqeqgHoaUhsLYxvwxo9mLH/KmsdwFMhKYZEZMunugOBMc O2JA6XqTgBacZSfyzLWfAA3zWYA4u1e4B4pdxsAQSgBXKUH0wxBQNrtOmgJHAoG2jMae9P2XVDP N1O2c9vlpTB8x2585fg== X-Authority-Analysis: v=2.4 cv=dcqNHHXe c=1 sm=1 tr=0 ts=69ae6e0b cx=c_pps a=50t2pK5VMbmlHzFWWp8p/g==:117 a=ZsC4DHZuhs/kKio7QBcDoQ==:17 a=Yq5XynenixoA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=eoimf2acIAo5FJnRuUoq:22 a=EUspDBNiAAAA:8 a=FTFSxu1yF2iZ1NjiFwcA:9 a=IoWCM6iH3mJn3m4BftBB:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-09_02,2026-03-06_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 bulkscore=0 spamscore=0 lowpriorityscore=0 adultscore=0 clxscore=1015 impostorscore=0 malwarescore=0 priorityscore=1501 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2602130000 definitions=main-2603090061 Content-Type: text/plain; charset="utf-8" lpass ports numbers have been added but the afe/apm driver never got updated with new max port value that it uses to store dai specific data. There are more than one places these values are cached and always become out of sync. This will result in array out of bounds and weird driver behaviour. To catch such issues, first add a single place where we can define max port and second add a check in common parsing code which can error out before corrupting the memory with out of bounds array access. This should help both avoid and catch these type of mistakes in future. Signed-off-by: Srinivas Kandagatla --- sound/soc/qcom/common.c | 6 ++++++ sound/soc/qcom/common.h | 3 +++ sound/soc/qcom/lpass.h | 3 ++- sound/soc/qcom/qdsp6/q6afe.h | 3 ++- sound/soc/qcom/qdsp6/q6apm.h | 3 ++- 5 files changed, 15 insertions(+), 3 deletions(-) diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c index 7ee60a58a336..cf1f3a767cee 100644 --- a/sound/soc/qcom/common.c +++ b/sound/soc/qcom/common.c @@ -120,6 +120,12 @@ int qcom_snd_parse_of(struct snd_soc_card *card) =20 link->id =3D args.args[0]; =20 + if (link->id >=3D LPASS_MAX_PORT) { + dev_err(dev, "%s: Invalid cpu dai id %d\n", link->name, link->id); + ret =3D -EINVAL; + goto err; + } + if (platform) { link->platforms->of_node =3D of_parse_phandle(platform, "sound-dai", diff --git a/sound/soc/qcom/common.h b/sound/soc/qcom/common.h index 1b8d3f90bffa..ee6662885593 100644 --- a/sound/soc/qcom/common.h +++ b/sound/soc/qcom/common.h @@ -4,8 +4,11 @@ #ifndef __QCOM_SND_COMMON_H__ #define __QCOM_SND_COMMON_H__ =20 +#include #include =20 +#define LPASS_MAX_PORT (SENARY_MI2S_TX + 1) + int qcom_snd_parse_of(struct snd_soc_card *card); int qcom_snd_wcd_jack_setup(struct snd_soc_pcm_runtime *rtd, struct snd_soc_jack *jack, bool *jack_setup); diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h index de3ec6f594c1..68b71039b981 100644 --- a/sound/soc/qcom/lpass.h +++ b/sound/soc/qcom/lpass.h @@ -14,10 +14,11 @@ #include #include #include +#include "common.h" #include "lpass-hdmi.h" =20 #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000 -#define LPASS_MAX_PORTS (DISPLAY_PORT_RX_7 + 1) +#define LPASS_MAX_PORTS (LPASS_MAX_PORT) #define LPASS_MAX_MI2S_PORTS (8) #define LPASS_MAX_DMA_CHANNELS (8) #define LPASS_MAX_HDMI_DMA_CHANNELS (4) diff --git a/sound/soc/qcom/qdsp6/q6afe.h b/sound/soc/qcom/qdsp6/q6afe.h index a29abe4ce436..0b8c3ec1315c 100644 --- a/sound/soc/qcom/qdsp6/q6afe.h +++ b/sound/soc/qcom/qdsp6/q6afe.h @@ -2,8 +2,9 @@ =20 #ifndef __Q6AFE_H__ #define __Q6AFE_H__ +#include "../common.h" =20 -#define AFE_PORT_MAX 137 +#define AFE_PORT_MAX (LPASS_MAX_PORT) =20 #define MSM_AFE_PORT_TYPE_RX 0 #define MSM_AFE_PORT_TYPE_TX 1 diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h index 7ce08b401e31..5cf538397841 100644 --- a/sound/soc/qcom/qdsp6/q6apm.h +++ b/sound/soc/qcom/qdsp6/q6apm.h @@ -14,9 +14,10 @@ #include #include #include +#include "../common.h" #include "audioreach.h" =20 -#define APM_PORT_MAX 127 +#define APM_PORT_MAX LPASS_MAX_PORT #define APM_PORT_MAX_AUDIO_CHAN_CNT 8 #define PCM_CHANNEL_NULL 0 #define PCM_CHANNEL_FL 1 /* Front left channel. */ --=20 2.47.3