linux-kernel - [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260110201959.2523024-1-harshit.m.mogalapalli@oracle.com>
Date: Sat, 10 Jan 2026 12:19:58 -0800
From: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>
To: Vinod Koul <vkoul@...nel.org>, Bard Liao <yung-chuan.liao@...ux.intel.com>,
        Pierre-Louis Bossart <pierre-louis.bossart@...ux.dev>,
        Charles Keepax <ckeepax@...nsource.cirrus.com>,
        linux-sound@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: dan.carpenter@...aro.org, kernel-janitors@...r.kernel.org,
        error27@...il.com,
        Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>,
        kernel test robot <lkp@...el.com>
Subject: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

ida_alloc_max() interprets its max argument as inclusive.

Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
allocated, but the IRQ domain created for the bus is sized for IDs
0-15.  If 16 is returned, irq_create_mapping() fails and the driver
ends up with an invalid IRQ mapping.

Limit the allocation to 0-15 by passing SDW_FW_MAX_DEVICES - 1.

Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
Closes: https://lore.kernel.org/r/202512240450.hlDH3nCs-lkp@intel.com/
Fixes: aab12022b076 ("soundwire: bus: Add internal slave ID and use for IRQs")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>
---
Only compile tested.
---
 drivers/soundwire/bus_type.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soundwire/bus_type.c b/drivers/soundwire/bus_type.c
index 80ed3468e860..a05aa36828cb 100644
--- a/drivers/soundwire/bus_type.c
+++ b/drivers/soundwire/bus_type.c
@@ -99,7 +99,7 @@ static int sdw_bus_probe(struct device *dev)
 	if (ret)
 		return ret;
 
-	ret = ida_alloc_max(&slave->bus->slave_ida, SDW_FW_MAX_DEVICES, GFP_KERNEL);
+	ret = ida_alloc_max(&slave->bus->slave_ida, SDW_FW_MAX_DEVICES - 1, GFP_KERNEL);
 	if (ret < 0) {
 		dev_err(dev, "Failed to allocated ID: %d\n", ret);
 		return ret;
-- 
2.47.3