From nobody Mon Apr 6 09:13:44 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0DC673CBE77 for ; Fri, 20 Mar 2026 14:49:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774018181; cv=none; b=N2p4R6e7z+azhcWFm34F74q19ZBBuIqbleGoeyAEQayVXFyUDfAz3s/K6DC41s0/yk3bnOa8T5ZiHuAmwWORrSze/Jidu/pms1umr7DAy8tN9Hd2tT/pHB5jufJtcnm1/vLEED8bAlm9fuO+kE0skoCtKq6BIQAQDw3HORNE71Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774018181; c=relaxed/simple; bh=CrLGv5edH+UZPIk9+prSCn/qT8iVjWiDSBnsGzRqcxE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=llqTYZ//cCNNJLNwYeKm/jus2AbicYHuFXc7mQ0XankzaUsrXmmKrQeOB74vXibg6rb5VLLWjn77VJlSQw/FDO2SNsBJpTJxXQOYToX1P7BsDn0cmSthV9tECF7D9EbXs2cGvvwWmKrB3wgsnzpbJUYb9Ka/ULGknfKbqKE9l5Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=ex6PhGk+; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=Io7oFoAK; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="ex6PhGk+"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="Io7oFoAK" Received: from pps.filterd (m0279870.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 62KEXaWW1691830 for ; Fri, 20 Mar 2026 14:49:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=aiejSc4X5A/ gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=ex6PhGk+hwkp+aQgRMUmR5edSIB o8qn7Gs3qrueSo5JgvUnRz2j2EDDPyX3BE0mw4RYEA2WuboBHzAZxnRNH8kEQOzJ n5Z5+jO+bRGylLE/T0WqAxKZIoPH6ZUcfp6annnBc8NrI9WpHiNSzgHQae0I33+6 8LJgu0PBwiwB56goJ60GKOcVIXHWQa7tRLVFhAKN4khOL9QAslNEMgyq7F555zHG buofdsGRAAEsm2GROmCoOWOcxhMkqVu7dDGcUtpYSMJ94Q/kuhwSbYIN8quYJgp9 jT2aeuATUnmv6/Kw22rdmlTym++RsboAiDneha1yJSKHGffRlB42YYwwe0Q== Received: from mail-qt1-f197.google.com (mail-qt1-f197.google.com [209.85.160.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4d0s5d2aq3-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 20 Mar 2026 14:49:39 +0000 (GMT) Received: by mail-qt1-f197.google.com with SMTP id d75a77b69052e-50b4031b86dso29362631cf.0 for ; Fri, 20 Mar 2026 07:49:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1774018178; x=1774622978; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=aiejSc4X5A/gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=Io7oFoAKu7Y6dwrMzHPKnd+EEjgpoPhGOyDBahhiZK4xzBId/IbFa6SIEdi5YvYy// 4Zo4xeGeHt+2Ci8YIRE7Und7+sXbSr+FZkHFpjRApLG+kbf0XZdXUJ1zDFjln4Eu5aqk ly3zZeDftFyO3Vi59R5krKI4lGWY1f6nEMsB+K29npNc/pO3mW2zcDTedgLpGJjDCrQ5 xpwT4AQLHpkopiUUeFWoeRCb1ZsowbWeogkeSSHdytYbCEj1bFLe/p2XtcpKEuemB5hs p2ti1QeADz4lTDS3rb0lEUp586E1tYpOYSJqvvk0bXRJymxxQGuv0tU76xioe51yHgCp yj1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774018178; x=1774622978; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=aiejSc4X5A/gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=OX9epqPdKaiLdFylsq6n0QFBxyEuHXAQyXGQ7sQ7pXg/76rusi9etlTegaZtzBjR5L 6TUIhCh4GHocda+77zi6HspDJdOYyq/AbhC5g+vmWIv6Wy17AzrmIT2qdQnqkPq/38a4 92Zz2DuGoCOwFGa/eRGAob4gIeWQtRaYhTueqr1eIyMcVTNK4wbGTfcCyy+i8whCDdK+ NbYOTTPDFUXYCNl4IhvypLdcweUE4+aGXS46aw8wqlj+jtBIStMx1X3a9ZtHIoWLBWfj oeep58yeK1xEHaZJrdUo9yAM/b9Wq7b9Tp0GlFLRLXD39jwhZpnwEc2sP7/0I520kS9F r8Xg== X-Forwarded-Encrypted: i=1; AJvYcCUuNOAZ35JhmHPEfJLojy/e/7wpA36sWK9grsXhSOO6dbJT72J+EYSq4kV94BQIIR2YtAyTg1i1ZjbI+LQ=@vger.kernel.org X-Gm-Message-State: AOJu0YyqPeeJvs35ilojjCg0D0j71GqKbz/0zOUjX8E/M8mv7wGSKJh/ 3vxGNTcs6rwkGCBDj+FfWyy/ZDWpfqwmMgzRNobZEhMHIVpg3hzoEgFZNBbjr6gqCHr/xaht33z Smi91MIozpSWYBrhIjrZmMBJPokR+JMEoZxDcaRsgrVhr8JJEGbrGWmLmKzXmRkfgMyY= X-Gm-Gg: ATEYQzzNsNB9z1up47/o57Il9DtRm+bAm7d7KLl7now6YnkwUF3ZhU9d7nNc7itHQ33 qzS5rmb7aoqfjkb4/icWa2BFPJHjNvbxW35pkDQkRBfL5YpKa8LKcg3AbitSEKH0a6Bt3jxCMQV wLALPiGf45+MG9/UhIXXLHARyATBvmOoTT74DD4wW+HaFKfTmRE01WrGQZIXqWArz/p4SsJkkI6 YKpGX5Rcsv35wZs6IRiiaTaRkrWITHpMSPZjHaTr3DWGTOyZog6zHPF15TPdX6Uco9BkrdpDA2a BptYoL7Cl92zB3nAag++/07+uvaJCGsEKB/jq8oAJsaVvQ1q89YM/3K5v/c1kd1lijzTt7hsEI/ HeSCnBqxuG+6skBGLt2tRqLEk+vtMK7WhgxQYvWhYZvukFsdhe+/iOn4= X-Received: by 2002:a05:622a:2c1:b0:509:1568:1f16 with SMTP id d75a77b69052e-50b375d4d49mr45800771cf.71.1774018178283; Fri, 20 Mar 2026 07:49:38 -0700 (PDT) X-Received: by 2002:a05:622a:2c1:b0:509:1568:1f16 with SMTP id d75a77b69052e-50b375d4d49mr45800131cf.71.1774018177827; Fri, 20 Mar 2026 07:49:37 -0700 (PDT) Received: from localhost.localdomain ([5.133.47.210]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-486ff109b95sm47906825e9.1.2026.03.20.07.49.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 20 Mar 2026 07:49:37 -0700 (PDT) From: Srinivas Kandagatla To: broonie@kernel.org, robh@kernel.org, krzk+dt@kernel.org, conor+dt@kernel.org Cc: mohammad.rafi.shaik@oss.qualcomm.com, linux-sound@vger.kernel.org, lgirdwood@gmail.com, perex@perex.cz, tiwai@suse.com, johan@kernel.org, dmitry.baryshkov@oss.qualcomm.com, konrad.dybcio@oss.qualcomm.com, linux-arm-msm@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, srini@kernel.org, val@packett.cool, mailingradian@gmail.com, Srinivas Kandagatla Subject: [PATCH v6 09/13] ASoC: qcom: common: validate cpu dai id during parsing Date: Fri, 20 Mar 2026 14:49:14 +0000 Message-ID: <20260320144918.1685838-10-srinivas.kandagatla@oss.qualcomm.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260320144918.1685838-1-srinivas.kandagatla@oss.qualcomm.com> References: <20260320144918.1685838-1-srinivas.kandagatla@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-ORIG-GUID: cXLR4JGHJi-vwoiheJMRoOjQ0pbvQa-M X-Proofpoint-GUID: cXLR4JGHJi-vwoiheJMRoOjQ0pbvQa-M X-Authority-Analysis: v=2.4 cv=CqCys34D c=1 sm=1 tr=0 ts=69bd5e83 cx=c_pps a=EVbN6Ke/fEF3bsl7X48z0g==:117 a=ZsC4DHZuhs/kKio7QBcDoQ==:17 a=Yq5XynenixoA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=gowsoOTTUOVcmtlkKump:22 a=EUspDBNiAAAA:8 a=FTFSxu1yF2iZ1NjiFwcA:9 a=a_PwQJl-kcHnX1M80qC6:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzIwMDExOCBTYWx0ZWRfX6JkrPNXM5DnN F+0Tm9oG28tFYHSPkNt77uUfKAgcPg8eqWNVpii2mWhMgrc22Jv963VmM94rpDaUUUQh6Av30DX cjk3trC0T6imrFC3Wyum9wwM19IyDbsEC/SOfJSPaVoWrTZv3Q4wT075mRHytBzXR2G4qWiwwka BOA3NaH37898WlSBBEyy1URVzHvBZdPuCFectWI5EdSJJzF/eCyriZqfgIbsz+GbJq7rpJKSsqn sesM6f2OCCS1p5duIxp+DUqaQtPx+8jZGani+TPitmHw9CDP8Mhfo9dI6yktjBwlfcHdhIDjqCq MqK6DTUSj4f0HeW/jNhhDJyMtAMjgMo6JACRcdp3xl879TPqWuHykEAa7bTnCX4OEIpPNeikevr U/4adjfgdanCxcvL9Qg5+UnoKOgBde9TzNPhConjPfdbKtkKCR98jJyRS+jydq/sIqngeEF35SS iuiRfj94H9MqkUiW+WQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-20_02,2026-03-19_05,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 bulkscore=0 malwarescore=0 suspectscore=0 impostorscore=0 phishscore=0 priorityscore=1501 adultscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2603200118 Content-Type: text/plain; charset="utf-8" lpass ports numbers have been added but the afe/apm driver never got updated with new max port value that it uses to store dai specific data. There are more than one places these values are cached and always become out of sync. This will result in array out of bounds and weird driver behaviour. To catch such issues, first add a single place where we can define max port and second add a check in common parsing code which can error out before corrupting the memory with out of bounds array access. This should help both avoid and catch these type of mistakes in future. Signed-off-by: Srinivas Kandagatla --- sound/soc/qcom/common.c | 6 ++++++ sound/soc/qcom/common.h | 3 +++ sound/soc/qcom/lpass.h | 3 ++- sound/soc/qcom/qdsp6/q6afe.h | 3 ++- sound/soc/qcom/qdsp6/q6apm.h | 3 ++- 5 files changed, 15 insertions(+), 3 deletions(-) diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c index 7ee60a58a336..cf1f3a767cee 100644 --- a/sound/soc/qcom/common.c +++ b/sound/soc/qcom/common.c @@ -120,6 +120,12 @@ int qcom_snd_parse_of(struct snd_soc_card *card) =20 link->id =3D args.args[0]; =20 + if (link->id >=3D LPASS_MAX_PORT) { + dev_err(dev, "%s: Invalid cpu dai id %d\n", link->name, link->id); + ret =3D -EINVAL; + goto err; + } + if (platform) { link->platforms->of_node =3D of_parse_phandle(platform, "sound-dai", diff --git a/sound/soc/qcom/common.h b/sound/soc/qcom/common.h index 1b8d3f90bffa..ee6662885593 100644 --- a/sound/soc/qcom/common.h +++ b/sound/soc/qcom/common.h @@ -4,8 +4,11 @@ #ifndef __QCOM_SND_COMMON_H__ #define __QCOM_SND_COMMON_H__ =20 +#include #include =20 +#define LPASS_MAX_PORT (SENARY_MI2S_TX + 1) + int qcom_snd_parse_of(struct snd_soc_card *card); int qcom_snd_wcd_jack_setup(struct snd_soc_pcm_runtime *rtd, struct snd_soc_jack *jack, bool *jack_setup); diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h index de3ec6f594c1..68b71039b981 100644 --- a/sound/soc/qcom/lpass.h +++ b/sound/soc/qcom/lpass.h @@ -14,10 +14,11 @@ #include #include #include +#include "common.h" #include "lpass-hdmi.h" =20 #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000 -#define LPASS_MAX_PORTS (DISPLAY_PORT_RX_7 + 1) +#define LPASS_MAX_PORTS (LPASS_MAX_PORT) #define LPASS_MAX_MI2S_PORTS (8) #define LPASS_MAX_DMA_CHANNELS (8) #define LPASS_MAX_HDMI_DMA_CHANNELS (4) diff --git a/sound/soc/qcom/qdsp6/q6afe.h b/sound/soc/qcom/qdsp6/q6afe.h index a29abe4ce436..0b8c3ec1315c 100644 --- a/sound/soc/qcom/qdsp6/q6afe.h +++ b/sound/soc/qcom/qdsp6/q6afe.h @@ -2,8 +2,9 @@ =20 #ifndef __Q6AFE_H__ #define __Q6AFE_H__ +#include "../common.h" =20 -#define AFE_PORT_MAX 137 +#define AFE_PORT_MAX (LPASS_MAX_PORT) =20 #define MSM_AFE_PORT_TYPE_RX 0 #define MSM_AFE_PORT_TYPE_TX 1 diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h index 7ce08b401e31..5cf538397841 100644 --- a/sound/soc/qcom/qdsp6/q6apm.h +++ b/sound/soc/qcom/qdsp6/q6apm.h @@ -14,9 +14,10 @@ #include #include #include +#include "../common.h" #include "audioreach.h" =20 -#define APM_PORT_MAX 127 +#define APM_PORT_MAX LPASS_MAX_PORT #define APM_PORT_MAX_AUDIO_CHAN_CNT 8 #define PCM_CHANNEL_NULL 0 #define PCM_CHANNEL_FL 1 /* Front left channel. */ --=20 2.47.3