linux-kernel - [PATCH v2] ASoC: q6apm: fix potential overflow in q6hdmi_hw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251013133906.3299497-1-n.zhandarovich@fintech.ru>
Date: Mon, 13 Oct 2025 16:39:04 +0300
From: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To: Srinivas Kandagatla <srini@...nel.org>, Liam Girdwood
	<lgirdwood@...il.com>, Jaroslav Kysela <perex@...ex.cz>, Takashi Iwai
	<tiwai@...e.com>
CC: Nikita Zhandarovich <n.zhandarovich@...tech.ru>,
	<linux-sound@...r.kernel.org>, <linux-arm-msm@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>
Subject: [PATCH v2] ASoC: q6apm: fix potential overflow in q6hdmi_hw_params

Since 'module_config' array in struct 'q6apm_lpass_dai_data' has fixed
size APM_PORT_MAX (127), function q6hdmi_hw_params() may hit
accidental buffer overflow. Specifically, in case 'dai->id' has
values ranging between DISPLAY_PORT_RX_1 and DISPLAY_PORT_RX_7,
DISPLAY_PORT_RX_1 being equal 129, module_config[] array will
attempt to access elements out of reach.

Mitigate this issue by expanding the maximum possible size of
'module_config' and increasing APM_PORT_MAX to account for bigger
possible values for indexes.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 2f6860e6133f ("ASoC: qcom: q6apm: add support to display ports in lpass dais")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
---
P.S. This issue is quite similar to another, already fixed one, see
commit a31a4934b31f ("ASoC: qcom: Fix sc7280 lpass potential buffer
overflow").

v1 -> v2: increase APM_PORT_MAX by 1 to ensure that no overflow
occurs if dai->id is equal to max possible value (DISPLAY_PORT_RX_7).
Thanks to Fedor Pchelkin <pchelkin@...ras.ru> for the suggestion.
Also, expand description a tiny bit.
---
 sound/soc/qcom/qdsp6/q6apm.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h
index 7ce08b401e31..fa766c038d78 100644
--- a/sound/soc/qcom/qdsp6/q6apm.h
+++ b/sound/soc/qcom/qdsp6/q6apm.h
@@ -14,9 +14,10 @@
 #include <linux/of_platform.h>
 #include <linux/jiffies.h>
 #include <linux/soc/qcom/apr.h>
+#include <dt-bindings/sound/qcom,q6dsp-lpass-ports.h>
 #include "audioreach.h"
 
-#define APM_PORT_MAX		127
+#define APM_PORT_MAX		(DISPLAY_PORT_RX_7 + 1)
 #define APM_PORT_MAX_AUDIO_CHAN_CNT 8
 #define PCM_CHANNEL_NULL 0
 #define PCM_CHANNEL_FL    1	/* Front left channel. */