From nobody Sun Apr 5 18:21:02 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 18328382F22 for ; Mon, 23 Mar 2026 22:39:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774305554; cv=none; b=on8tR2WLYd6AUgiB5zFgXP+42Sl9LafmQR00GCm1ZnHSntibEkcBu09YlM3ih2clz5Vr4u1LG9qDF1FSiG2JkF9GEnedz7SGv2sxW1ccg0IAhcHI/UgzP8E3VxnTij60kPEI9+bQGh6+u5noZKKicZY4wWFURfAKR9zNM9POf3A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774305554; c=relaxed/simple; bh=CrLGv5edH+UZPIk9+prSCn/qT8iVjWiDSBnsGzRqcxE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=O66lsupeQ33N8e1NThTOhckMPBLQm8GuO28xNA1Pd5xSgcePtSuaiTJwxJ1T/getMj3i04mRS6IsDis1PBct6N9s5LcUOEROXzEaRVYUxHwNHY2MVzi85ZxQwonO5D8FyUjoVPWQBdFXkhYmJNY7X9rsI2IInfoLBoDICgrRMPw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=QJ2kD7eZ; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=e1/1+YHI; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="QJ2kD7eZ"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="e1/1+YHI" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 62NHqgvC3170992 for ; Mon, 23 Mar 2026 22:39:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=aiejSc4X5A/ gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=QJ2kD7eZ+YvhmGGDHuQEChlMndd qZF3loald53N2NcXT6vW9/EIvM7p/kO+WVi7L7bbIlBje0U/MvBy51rvZM5Bselm FIxmGe7iJhc4GXI8TO2KhtCNVtDrDyGWZO6eEfnsyEF1eUiZRUUPu9W4OgL9OAVZ 4cfSPa1+isqeLKsNTavLPjXt4lPWpE8yn/s66vUJQadXAIhFIXHdfOwahAchGEnK ZDulcbFK/SRhEHyMIlaefS0IwlbUg5r4VriDvXoZl3Zaep/W1Ntnjie0FjNWjc9w EdP6/iDYsz8kK8Tp6CYEgSh1ISU3gl6OYcUFR2K36ezP5zoSGDkCBbtlAWw== Received: from mail-qt1-f200.google.com (mail-qt1-f200.google.com [209.85.160.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4d35r21y6h-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 23 Mar 2026 22:39:12 +0000 (GMT) Received: by mail-qt1-f200.google.com with SMTP id d75a77b69052e-50b4fe4ff7bso200307471cf.0 for ; Mon, 23 Mar 2026 15:39:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1774305551; x=1774910351; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=aiejSc4X5A/gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=e1/1+YHItIeN0aQZU4D+BMxMGmcEdlfIVO8++/21OhE3VslO0B0IxzYF/UiBdaY9c3 taY2rH9sVlanD0OcoG3JV9wNkUIPQzVMr81RFzYLTIMU0jmqvSqIbSRU16fK9qnvL1Qs C/sWcVG3LkxoWSwAbT9xHtd2GH6BwdkH7eNcjNAKcTFziTT5emBsc/w8BlWgcq89r/RW aUZBJ9WhjEzWTBi1DEvlSXp9cPacDZYBV6bb5GI9iWMQuVqs/iCldhfgInRi8UnPp+01 WsWdpGijmSSLq/QlBx5oJbTQh9adpfzZyYZdJzyeaZF/YIfMJoBl5YspFp2Zcp/wrKk4 ZR2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774305551; x=1774910351; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=aiejSc4X5A/gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=i5JsSZRUJ6ilWMAwqRd0M4m218wLUydaYBo/MmB9sjxUmek4cP4OaKGqYuPILySoNi N1c1YAbtAm5Q/pMwoHZ/UdZBri3LjBUTvpKJd2flmDaxFFQh2DvRgqnuWyE4Hdzi2P09 UciGUsT1TYmu1Tw3rrd0/X23uqj8F1ofCyTvjwflNcIRxfULjWsIeglmbDI0ih5+Ef1a Jok7bus5muPoc0r+ko7nUuo+SVVbIAeYdKgIXGy44nzNPy+vOIJwTdL+5Xl0OQobzNFE NK+QLsQU/5T6A4wq5jF46T7x/DyFPitDD9/ERcUdk7agVKf+BYGzOhST0B7+Wcl7dQUz 3TzQ== X-Forwarded-Encrypted: i=1; AJvYcCXxGvO2+5awunDEL9T5PEw6E+Ul5J6N6r+gW8Bwq6SJhANrRc1p5bc+5dILbPL+jG/harSaslR7yaR0E0k=@vger.kernel.org X-Gm-Message-State: AOJu0Yy1/Bp/wpGA8JPx/fq40G1URCEJSCfMj6GLib5YJFiWvN1fNDbg tWIlcWIwa3ut7Wr0gv5b5xzV0LdazBXhJa83onGhR3tAWorPNMBGbfJSlK0Vjgb8XdRRq4yllg3 F+dmQeEO4Rq4DniqbIN5AhK49w1pyc8oKv+wyDaYAH851IltCTiKWWvKggKtSOt75618= X-Gm-Gg: ATEYQzwHu1iqiXFeRbcmZWaFvtstUiqgW+m7ZDypXXradreb9gd1GUFmZRYV6d2XqI0 K/tFmCHn1RL+u2c83qtkghUJ4b5oky1Tj9AQUR/+M7DeBYWKd/K9U2X38ANhmJ32ZSHAJumL2v/ qNhoKtp7zkhRhswTIJw+VM3yN2xCLEVB1amkRBkI6LGULhIKf6b6/WHz48Lepga1n9QnXDla33O URqksPDC7NGqSkObTakV8rbI/kuh8iG0798t5Adgfca+YFw5czjyuCShloBBo9d4Qh58x8cxv0Z +Wh0J+FMTCH7FTB3FjxU/GOvAsTiGkdvzBVnpT7tgi3AjG2O+rWKPlrfWnj0ljw10+40mu2MYnU ckYfVnPyZVGizyNWxO4KbKbrp/msrvK+WHsksTnre9r28JMBIf/losSw= X-Received: by 2002:ac8:714b:0:b0:509:1b5c:fe25 with SMTP id d75a77b69052e-50b6ee5ccc1mr16161591cf.23.1774305551419; Mon, 23 Mar 2026 15:39:11 -0700 (PDT) X-Received: by 2002:ac8:714b:0:b0:509:1b5c:fe25 with SMTP id d75a77b69052e-50b6ee5ccc1mr16161301cf.23.1774305550963; Mon, 23 Mar 2026 15:39:10 -0700 (PDT) Received: from localhost.localdomain ([5.133.47.210]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43b64715539sm33320351f8f.33.2026.03.23.15.39.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 23 Mar 2026 15:39:10 -0700 (PDT) From: Srinivas Kandagatla To: broonie@kernel.org, robh@kernel.org, krzk+dt@kernel.org, conor+dt@kernel.org Cc: mohammad.rafi.shaik@oss.qualcomm.com, linux-sound@vger.kernel.org, lgirdwood@gmail.com, perex@perex.cz, tiwai@suse.com, johan@kernel.org, dmitry.baryshkov@oss.qualcomm.com, konrad.dybcio@oss.qualcomm.com, linux-arm-msm@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, srini@kernel.org, val@packett.cool, mailingradian@gmail.com, Srinivas Kandagatla Subject: [PATCH v7 09/13] ASoC: qcom: common: validate cpu dai id during parsing Date: Mon, 23 Mar 2026 22:38:41 +0000 Message-ID: <20260323223845.2126142-10-srinivas.kandagatla@oss.qualcomm.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260323223845.2126142-1-srinivas.kandagatla@oss.qualcomm.com> References: <20260323223845.2126142-1-srinivas.kandagatla@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Authority-Analysis: v=2.4 cv=VvUuwu2n c=1 sm=1 tr=0 ts=69c1c110 cx=c_pps a=JbAStetqSzwMeJznSMzCyw==:117 a=ZsC4DHZuhs/kKio7QBcDoQ==:17 a=Yq5XynenixoA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=EUspDBNiAAAA:8 a=FTFSxu1yF2iZ1NjiFwcA:9 a=uxP6HrT_eTzRwkO_Te1X:22 X-Proofpoint-GUID: IvWVXvZUdtn-0g8UvIOrcw0C1eFtLwT9 X-Proofpoint-ORIG-GUID: IvWVXvZUdtn-0g8UvIOrcw0C1eFtLwT9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzIzMDE2NyBTYWx0ZWRfXx6+gT7hXfgYW r4w/xsfjfqXnpRSyIB8GcdSV7070YhOSZxltSGYZBJ6vEEcqUvuTiZX+nMfUu8L/QKWfBLkLs8C eMz3TQE9p4WAR0LxFr4SRyt6qp4fHvwsI3/aEV8WNO3Ql3v/TD2WgpcqI3PhJQ/W6XQAxxr4+fk rYmSLh5zl2GXs5V1vM+sKiBXGNEXp0sNK9M7ufHxq73rkSBxYkNxj5B4m95m2FEsZZgX45kRspo N9PJfKVnjQQmIkMwYZRolrkJZmchgvlFX2vOzd5bWO0jf7H4Edakq9cpRP0NQDefPw4wBSrx6lR jUu4+t1Iid4nIWF7+Z4HiRIgxnbI4rEkjIZNUV3LGF9sDYK0lX8Wl2XTFjP+iDJ8gSR5hzo3c+a YB39FlMDF9UJu3SRke+9LpHyUw7YauQCYhpvu7gKqzVzlr5wjL1Gk1Eu2YH0HcuGK+rs4UTpluB a/cDGiHHIqRLhMjczOQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-23_06,2026-03-23_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 malwarescore=0 spamscore=0 adultscore=0 lowpriorityscore=0 impostorscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2603230167 Content-Type: text/plain; charset="utf-8" lpass ports numbers have been added but the afe/apm driver never got updated with new max port value that it uses to store dai specific data. There are more than one places these values are cached and always become out of sync. This will result in array out of bounds and weird driver behaviour. To catch such issues, first add a single place where we can define max port and second add a check in common parsing code which can error out before corrupting the memory with out of bounds array access. This should help both avoid and catch these type of mistakes in future. Signed-off-by: Srinivas Kandagatla --- sound/soc/qcom/common.c | 6 ++++++ sound/soc/qcom/common.h | 3 +++ sound/soc/qcom/lpass.h | 3 ++- sound/soc/qcom/qdsp6/q6afe.h | 3 ++- sound/soc/qcom/qdsp6/q6apm.h | 3 ++- 5 files changed, 15 insertions(+), 3 deletions(-) diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c index 7ee60a58a336..cf1f3a767cee 100644 --- a/sound/soc/qcom/common.c +++ b/sound/soc/qcom/common.c @@ -120,6 +120,12 @@ int qcom_snd_parse_of(struct snd_soc_card *card) =20 link->id =3D args.args[0]; =20 + if (link->id >=3D LPASS_MAX_PORT) { + dev_err(dev, "%s: Invalid cpu dai id %d\n", link->name, link->id); + ret =3D -EINVAL; + goto err; + } + if (platform) { link->platforms->of_node =3D of_parse_phandle(platform, "sound-dai", diff --git a/sound/soc/qcom/common.h b/sound/soc/qcom/common.h index 1b8d3f90bffa..ee6662885593 100644 --- a/sound/soc/qcom/common.h +++ b/sound/soc/qcom/common.h @@ -4,8 +4,11 @@ #ifndef __QCOM_SND_COMMON_H__ #define __QCOM_SND_COMMON_H__ =20 +#include #include =20 +#define LPASS_MAX_PORT (SENARY_MI2S_TX + 1) + int qcom_snd_parse_of(struct snd_soc_card *card); int qcom_snd_wcd_jack_setup(struct snd_soc_pcm_runtime *rtd, struct snd_soc_jack *jack, bool *jack_setup); diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h index de3ec6f594c1..68b71039b981 100644 --- a/sound/soc/qcom/lpass.h +++ b/sound/soc/qcom/lpass.h @@ -14,10 +14,11 @@ #include #include #include +#include "common.h" #include "lpass-hdmi.h" =20 #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000 -#define LPASS_MAX_PORTS (DISPLAY_PORT_RX_7 + 1) +#define LPASS_MAX_PORTS (LPASS_MAX_PORT) #define LPASS_MAX_MI2S_PORTS (8) #define LPASS_MAX_DMA_CHANNELS (8) #define LPASS_MAX_HDMI_DMA_CHANNELS (4) diff --git a/sound/soc/qcom/qdsp6/q6afe.h b/sound/soc/qcom/qdsp6/q6afe.h index a29abe4ce436..0b8c3ec1315c 100644 --- a/sound/soc/qcom/qdsp6/q6afe.h +++ b/sound/soc/qcom/qdsp6/q6afe.h @@ -2,8 +2,9 @@ =20 #ifndef __Q6AFE_H__ #define __Q6AFE_H__ +#include "../common.h" =20 -#define AFE_PORT_MAX 137 +#define AFE_PORT_MAX (LPASS_MAX_PORT) =20 #define MSM_AFE_PORT_TYPE_RX 0 #define MSM_AFE_PORT_TYPE_TX 1 diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h index 7ce08b401e31..5cf538397841 100644 --- a/sound/soc/qcom/qdsp6/q6apm.h +++ b/sound/soc/qcom/qdsp6/q6apm.h @@ -14,9 +14,10 @@ #include #include #include +#include "../common.h" #include "audioreach.h" =20 -#define APM_PORT_MAX 127 +#define APM_PORT_MAX LPASS_MAX_PORT #define APM_PORT_MAX_AUDIO_CHAN_CNT 8 #define PCM_CHANNEL_NULL 0 #define PCM_CHANNEL_FL 1 /* Front left channel. */ --=20 2.47.3