linux-kernel - [PATCH stable-6.10 regression] Revert "soundwire: stream: fix programming slave ports for non-continous port maps"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240910124009.10183-1-peter.ujfalusi@linux.intel.com>
Date: Tue, 10 Sep 2024 15:40:09 +0300
From: Peter Ujfalusi <peter.ujfalusi@...ux.intel.com>
To: vkoul@...nel.org,
	yung-chuan.liao@...ux.intel.com,
	pierre-louis.bossart@...ux.intel.com,
	krzysztof.kozlowski@...aro.org
Cc: alsa-devel@...a-project.org,
	linux-kernel@...r.kernel.org,
	stable@...r.kernel.org,
	gregkh@...uxfoundation.org
Subject: [PATCH stable-6.10 regression] Revert "soundwire: stream: fix programming slave ports for non-continous port maps"

The prop->src_dpn_prop and prop.sink_dpn_prop is allocated for the _number_
of ports and it is forced as 0 index based.

The original code was correct while the change to walk the bits and use
their position as index into the arrays is not correct.

For exmple we can have the prop.source_ports=0x2, which means we have one
port, but the prop.src_dpn_prop[1] is accessing outside of the allocated
memory.

This reverts commit 6fa78e9c41471fe43052cd6feba6eae1b0277ae3.

Cc: stable@...r.kernel.org # 6.10.y
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@...ux.intel.com>
---
Hi,

The reverted patch causes major regression on soundwire causing all audio
to fail.
Interestingly the patch is only in 6.10.8 and 6.10.9, not in mainline or linux-next.

soundwire sdw-master-0-1: Program transport params failed: -22
soundwire sdw-master-0-1: Program params failed: -22
SDW1-Playback: ASoC: error at snd_soc_link_prepare on SDW1-Playback: -22

Regards,
Peter 

 drivers/soundwire/stream.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
index 00191b1d2260..4e9e7d2a942d 100644
--- a/drivers/soundwire/stream.c
+++ b/drivers/soundwire/stream.c
@@ -1286,18 +1286,18 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_prop(struct sdw_slave *slave,
 					    unsigned int port_num)
 {
 	struct sdw_dpn_prop *dpn_prop;
-	unsigned long mask;
+	u8 num_ports;
 	int i;
 
 	if (direction == SDW_DATA_DIR_TX) {
-		mask = slave->prop.source_ports;
+		num_ports = hweight32(slave->prop.source_ports);
 		dpn_prop = slave->prop.src_dpn_prop;
 	} else {
-		mask = slave->prop.sink_ports;
+		num_ports = hweight32(slave->prop.sink_ports);
 		dpn_prop = slave->prop.sink_dpn_prop;
 	}
 
-	for_each_set_bit(i, &mask, 32) {
+	for (i = 0; i < num_ports; i++) {
 		if (dpn_prop[i].num == port_num)
 			return &dpn_prop[i];
 	}
-- 
2.46.0