From nobody Fri Apr 3 17:36:51 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D5C039FCDD for ; Thu, 2 Apr 2026 08:11:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775117514; cv=none; b=NP7ibLV9kbm5YQNLULf/mos0E8chXNStpPh8TWf+ieTI2445Ap+KIxNZwZMJWVjLc3/DPTNuZasBUsmlw0aagP5oVKbzrCK3GqjkIUpvptLPaLacAv1VfIMCeANOxCHSJc30yBxPruCtc8ZZ/FKgQsc58ingyzB4uoyD1IKb0Xo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775117514; c=relaxed/simple; bh=CrLGv5edH+UZPIk9+prSCn/qT8iVjWiDSBnsGzRqcxE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rqOw1HAVmfLXbbrb1SwoqFHuTY1eBHm/P2HJlzTHta7cD7jgmywjcT4hRloX/IgPla/6YYxTFIyRK0AEfmywxmA7yYkkVQxB56uepF2h52tYtambgxg25/Imm3GjE9yoS9+oXoqR/E5SIsTPHoAVdEuOf/g+ROnFWs0M0QAo1Go= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Nu/TB7aM; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=Es4JROTC; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Nu/TB7aM"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="Es4JROTC" Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6326w5o84010110 for ; Thu, 2 Apr 2026 08:11:40 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=aiejSc4X5A/ gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=Nu/TB7aMzjP/3OXLNrNULeF2mnT v+eTUU8pyh3TRGll0uqoY4XQdDMFoGT30QROIauWhhxVVMU1vUcYNNOlMCumf3JP sI7F3dqQkluY7eGKMG3nbuHGpormtghUWH3xRTNrWLc7ElxXYsqWF8A3WrQiQ+5h zopFFwREfl6TlQW+qxbFeKVwJRkofz1v3tk46FWCzdxzrg6vNUVMKPCvGLlZd/2U C64f9lcUkCdmU5lB4nlLc7d3h/EREq2tmcaxA/ZZtkGmgZHR6+yy5vjULROASM9i j+LTTOxFOJd/0gNxezd7n6H1GuquveRGvuq09H0YLpwxRsUbRPd+u1aJquA== Received: from mail-qt1-f198.google.com (mail-qt1-f198.google.com [209.85.160.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4d97e02y4g-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 02 Apr 2026 08:11:40 +0000 (GMT) Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-5093025ffecso15245111cf.0 for ; Thu, 02 Apr 2026 01:11:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1775117499; x=1775722299; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=aiejSc4X5A/gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=Es4JROTCG9IuwrflzNkGMB9QO+ZMJmYj/tzI0tZf16wPC3j89qDaX9PmS+CfzFbTVH SP+qiSNoafS5RUKtoOSVHH/68IWDMcjBK/k1jWxqmg8KwJKDBEUgXWjWGPYHjA2JNMpc VT7d092tye9pUaay4LXOFVk0EpoEdtp0QdARMzI0NOr9lCcesw7MpqNbChiVZkOOYf6+ pEOTt060jGvF64z+bBfIaHkGPQFZg19vEKhmwywscUo05nrYFHAKlIJTXI8oRJu/1wBa aWs0tdoQDmR3eUNEuvL0uxVE+d4yUmL+H225il16qT6RPmrDJoUQ5uS9ckBXTLf4afci 1IkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775117499; x=1775722299; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=aiejSc4X5A/gorkmczOj6dnKqerAsQHN9lH+LChbOlI=; b=mYY0KFBgc3beh7Wn5/bBl2woStiHcIkQw+d71n5k36me/5xtRw6ZyOVnEVKzGAjPo8 SNU3/1ZSq7uxk9RFNx4SWpGW6OGvt1xGWK0sc2VfAk2sQulPEBwBw0MzT0PUUkSmx8Mm SYQlgGFh/oH/FkAjFYJW7+cSZ8yqwvse52Bw9m86lBlBtE5EwSQhxY5d5PD9o2rgBcgI La49ElAhLVNZv29IZaJLI+sFXLWXSL5Kn6FlefXTAgtEd42FJhrs1CcM7Hn10S2BHMR9 IvQPPYRZ+FjtQ4VJEHuI9VNQCZBYAeVGXV/V+nIk1AozQF2hyH6gyLpm5Q2kjhcvjpDV 53Tw== X-Forwarded-Encrypted: i=1; AJvYcCVTIRoXqZRJcgQMkeAuZGS6dk6/RJ4OU8z+Z6P1Jhd7qKNrp5Lp1dkGzbhR0kD7MEOaA/sp2eTPKNGP0vQ=@vger.kernel.org X-Gm-Message-State: AOJu0Ywwalt9bFlFqUXDs5S0CJApBb6HGXZni6W0S7XnotsBGLBcyAcw yqNzPy4ege7OIcx7tPp/VeybVJG1PI9rlpBApcOE6PP1OV7kBHD2aaadA+rfdMo2rLV3Xs5Mj5C r2J9stJAWj9HJ5FI1n21dGZSYR5yvHnlD97HW3Xglt0CriSQjtwQoBRJLyz5ByxXLl4c= X-Gm-Gg: ATEYQzx2/xh/FyLdiORqoocOqmoQJz5IHPR8fwwGIlxEyfQkdAO7z5cFCaKfukt9lQI n1HYpx8fP65Gm1SvS7qzxYPFXAjfApKyifVcG7iJ9fnMiyPskQUh6qy/Av0EGLp9RAFARNMv94o Qsm42nN+Vm2n8eHXwLY762em8AVldsepPVVqju8iLpyweOTc7A8d88nwzpYH9gTczjntvEXmCov QOUr+6ln5QeB3lymF73j5qTudGBS9G0kAA3JhJpwGBez83MyRa0GNVeHGNyf/yzDQl3Z+rwdVWb EJuAOSOEc5mOIwAk/fAeKZa+JXkAVxYR5NayiYaTwHzb7Ehb15Npubn4W9DQV5+oXOKbARIU7XJ vQqBvHzrCZJMm15g27ovSe61PLRkoxPhR6njulZRLfi/7LbvmNkUiBAo= X-Received: by 2002:a05:622a:259a:b0:509:379b:d4e with SMTP id d75a77b69052e-50d3bcd2630mr104809191cf.32.1775117498936; Thu, 02 Apr 2026 01:11:38 -0700 (PDT) X-Received: by 2002:a05:622a:259a:b0:509:379b:d4e with SMTP id d75a77b69052e-50d3bcd2630mr104808901cf.32.1775117498517; Thu, 02 Apr 2026 01:11:38 -0700 (PDT) Received: from localhost.localdomain ([5.133.47.210]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43d1e2c3a01sm5712604f8f.12.2026.04.02.01.11.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Apr 2026 01:11:37 -0700 (PDT) From: Srinivas Kandagatla To: broonie@kernel.org, robh@kernel.org, krzk+dt@kernel.org, conor+dt@kernel.org Cc: mohammad.rafi.shaik@oss.qualcomm.com, linux-sound@vger.kernel.org, lgirdwood@gmail.com, perex@perex.cz, tiwai@suse.com, johan@kernel.org, dmitry.baryshkov@oss.qualcomm.com, konrad.dybcio@oss.qualcomm.com, linux-arm-msm@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, srini@kernel.org, val@packett.cool, mailingradian@gmail.com, Srinivas Kandagatla Subject: [PATCH v9 07/13] ASoC: qcom: common: validate cpu dai id during parsing Date: Thu, 2 Apr 2026 08:11:12 +0000 Message-ID: <20260402081118.348071-8-srinivas.kandagatla@oss.qualcomm.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260402081118.348071-1-srinivas.kandagatla@oss.qualcomm.com> References: <20260402081118.348071-1-srinivas.kandagatla@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Authority-Analysis: v=2.4 cv=fdGgCkQF c=1 sm=1 tr=0 ts=69ce24bc cx=c_pps a=mPf7EqFMSY9/WdsSgAYMbA==:117 a=ZsC4DHZuhs/kKio7QBcDoQ==:17 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=DJpcGTmdVt4CTyJn9g5Z:22 a=EUspDBNiAAAA:8 a=FTFSxu1yF2iZ1NjiFwcA:9 a=dawVfQjAaf238kedN5IG:22 X-Proofpoint-ORIG-GUID: tgweNQmS4sjTbvjgRjUXlAqt3mJUPvo1 X-Proofpoint-GUID: tgweNQmS4sjTbvjgRjUXlAqt3mJUPvo1 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDAyMDA3MiBTYWx0ZWRfX1q0jMXuExyjF MMP2fvKqAa6McmjNNKZndINMa0zKaGsb4UfJdafuJEiLmmPgLIqJWRJEqh3H/NGVB+OnpAwNbog YimleoBH32IrtAMmY+ZnJp73NUEoOzDUsPPj+Eo5YuliEcKdpo/P2QPZEMxQaAgQofrh+sxcoMF b9c174oXINxLJh1on7TTTJ89mIQhXXqKdkX6dY0F0unM5ye2uFMo+qFEANaqxurCrkH5gCiy719 MxsaRXlvP5OY9Ybe6PRrQxFIEZn69v9xFgHyUn21zKQoDP6hwmbC1jVKa7VVuqcPuowAdTPr/WE DWs0TV7NPfwSn6ybSamhdly2tENGFAiXy7fsOB6FW3L5tnkMopo33UyV5PUDwhmTaU0NqqyO7wM OXY2taXwLxaqrd2Y9tZvBDGJVll2MS2pmtosmeNrtdUVhmn34BVNsYk5WfkCF++Ji/9OnI5EHRA Vo8L1gk8RGaBhFabF2w== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-02_01,2026-04-02_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 adultscore=0 malwarescore=0 impostorscore=0 bulkscore=0 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2604020072 Content-Type: text/plain; charset="utf-8" lpass ports numbers have been added but the afe/apm driver never got updated with new max port value that it uses to store dai specific data. There are more than one places these values are cached and always become out of sync. This will result in array out of bounds and weird driver behaviour. To catch such issues, first add a single place where we can define max port and second add a check in common parsing code which can error out before corrupting the memory with out of bounds array access. This should help both avoid and catch these type of mistakes in future. Signed-off-by: Srinivas Kandagatla --- sound/soc/qcom/common.c | 6 ++++++ sound/soc/qcom/common.h | 3 +++ sound/soc/qcom/lpass.h | 3 ++- sound/soc/qcom/qdsp6/q6afe.h | 3 ++- sound/soc/qcom/qdsp6/q6apm.h | 3 ++- 5 files changed, 15 insertions(+), 3 deletions(-) diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c index 7ee60a58a336..cf1f3a767cee 100644 --- a/sound/soc/qcom/common.c +++ b/sound/soc/qcom/common.c @@ -120,6 +120,12 @@ int qcom_snd_parse_of(struct snd_soc_card *card) =20 link->id =3D args.args[0]; =20 + if (link->id >=3D LPASS_MAX_PORT) { + dev_err(dev, "%s: Invalid cpu dai id %d\n", link->name, link->id); + ret =3D -EINVAL; + goto err; + } + if (platform) { link->platforms->of_node =3D of_parse_phandle(platform, "sound-dai", diff --git a/sound/soc/qcom/common.h b/sound/soc/qcom/common.h index 1b8d3f90bffa..ee6662885593 100644 --- a/sound/soc/qcom/common.h +++ b/sound/soc/qcom/common.h @@ -4,8 +4,11 @@ #ifndef __QCOM_SND_COMMON_H__ #define __QCOM_SND_COMMON_H__ =20 +#include #include =20 +#define LPASS_MAX_PORT (SENARY_MI2S_TX + 1) + int qcom_snd_parse_of(struct snd_soc_card *card); int qcom_snd_wcd_jack_setup(struct snd_soc_pcm_runtime *rtd, struct snd_soc_jack *jack, bool *jack_setup); diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h index de3ec6f594c1..68b71039b981 100644 --- a/sound/soc/qcom/lpass.h +++ b/sound/soc/qcom/lpass.h @@ -14,10 +14,11 @@ #include #include #include +#include "common.h" #include "lpass-hdmi.h" =20 #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000 -#define LPASS_MAX_PORTS (DISPLAY_PORT_RX_7 + 1) +#define LPASS_MAX_PORTS (LPASS_MAX_PORT) #define LPASS_MAX_MI2S_PORTS (8) #define LPASS_MAX_DMA_CHANNELS (8) #define LPASS_MAX_HDMI_DMA_CHANNELS (4) diff --git a/sound/soc/qcom/qdsp6/q6afe.h b/sound/soc/qcom/qdsp6/q6afe.h index a29abe4ce436..0b8c3ec1315c 100644 --- a/sound/soc/qcom/qdsp6/q6afe.h +++ b/sound/soc/qcom/qdsp6/q6afe.h @@ -2,8 +2,9 @@ =20 #ifndef __Q6AFE_H__ #define __Q6AFE_H__ +#include "../common.h" =20 -#define AFE_PORT_MAX 137 +#define AFE_PORT_MAX (LPASS_MAX_PORT) =20 #define MSM_AFE_PORT_TYPE_RX 0 #define MSM_AFE_PORT_TYPE_TX 1 diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h index 7ce08b401e31..5cf538397841 100644 --- a/sound/soc/qcom/qdsp6/q6apm.h +++ b/sound/soc/qcom/qdsp6/q6apm.h @@ -14,9 +14,10 @@ #include #include #include +#include "../common.h" #include "audioreach.h" =20 -#define APM_PORT_MAX 127 +#define APM_PORT_MAX LPASS_MAX_PORT #define APM_PORT_MAX_AUDIO_CHAN_CNT 8 #define PCM_CHANNEL_NULL 0 #define PCM_CHANNEL_FL 1 /* Front left channel. */ --=20 2.47.3