Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

ASoC: qcom: Fix sc7280 lpass potential buffer overflow

Case values introduced in commit
5f78e1fb7a3e ("ASoC: qcom: Add driver support for audioreach solution")
cause out of bounds access in arrays of sc7280 driver data (e.g. in case
of RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params()).

Redefine LPASS_MAX_PORTS to consider the maximum possible port id for
q6dsp as sc7280 driver utilizes some of those values.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 77d0ffef793d ("ASoC: qcom: Add macro for lpass DAI id's max limit")
Cc: stable@vger.kernel.org # v6.0+
Suggested-by: Mikhail Kobuk <m.kobuk@ispras.ru>
Suggested-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Evgeny Pimenov <pimenoveu12@gmail.com>
Link: https://patch.msgid.link/20250401204058.32261-1-pimenoveu12@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

authored by

Evgeny Pimenov and committed by
Mark Brown
a31a4934 2b727b3f

+2 -1
+2 -1
sound/soc/qcom/lpass.h
··· 13 13 #include <linux/platform_device.h> 14 14 #include <linux/regmap.h> 15 15 #include <dt-bindings/sound/qcom,lpass.h> 16 + #include <dt-bindings/sound/qcom,q6afe.h> 16 17 #include "lpass-hdmi.h" 17 18 18 19 #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000 19 - #define LPASS_MAX_PORTS (LPASS_CDC_DMA_VA_TX8 + 1) 20 + #define LPASS_MAX_PORTS (DISPLAY_PORT_RX_7 + 1) 20 21 #define LPASS_MAX_MI2S_PORTS (8) 21 22 #define LPASS_MAX_DMA_CHANNELS (8) 22 23 #define LPASS_MAX_HDMI_DMA_CHANNELS (4)