linux-kernel - [PATCH] soundwire: Intel: test bus.bpt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260126054045.2504103-1-yung-chuan.liao@linux.intel.com>
Date: Mon, 26 Jan 2026 13:40:45 +0800
From: Bard Liao <yung-chuan.liao@...ux.intel.com>
To: linux-sound@...r.kernel.org,
	vkoul@...nel.org
Cc: vinod.koul@...aro.org,
	linux-kernel@...r.kernel.org,
	pierre-louis.bossart@...ux.dev,
	bard.liao@...el.com,
	simont@...nsource.cirrus.com
Subject: [PATCH] soundwire: Intel: test bus.bpt_stream before assigning it

We only allow up to 1 bpt stream running on a SoundWire bus.
bus.bpt_stream will be assigned when it is opened and will be set to
NULL when it is closed. We do check bus->bpt_stream_refcount if the
stream type is SDW_STREAM_BPT in sdw_master_rt_alloc(), but at that
moment the bpt stream is allocated and set to bus.bpt_stream. It will
lead to the original bus.bpt_stream be changed to the new and not used
bpt stream. And it will be released and set to NULL when
sdw_slave_bpt_stream_add() return error as it supposed to. Then the
original stream will try to use the NULL bus.bpt_stream.

Fixes: 4c1ce9f37d8a ("soundwire: intel_ace2x: add BPT send_async/wait callbacks")
Reported-by: Simon Trimmer <simont@...nsource.cirrus.com>
Signed-off-by: Bard Liao <yung-chuan.liao@...ux.intel.com>
Reviewed-by: Simon Trimmer <simont@...nsource.cirrus.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@...ux.intel.com>
---
 drivers/soundwire/intel_ace2x.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/soundwire/intel_ace2x.c b/drivers/soundwire/intel_ace2x.c
index 1ed0251d2592..9b3d110d021f 100644
--- a/drivers/soundwire/intel_ace2x.c
+++ b/drivers/soundwire/intel_ace2x.c
@@ -82,6 +82,11 @@ static int intel_ace2x_bpt_open_stream(struct sdw_intel *sdw, struct sdw_slave *
 	int len;
 	int i;

+	if (cdns->bus.bpt_stream) {
+		dev_err(cdns->dev, "%s: BPT stream already exists\n", __func__);
+		return -EAGAIN;
+	}
+
 	stream = sdw_alloc_stream("BPT", SDW_STREAM_BPT);
 	if (!stream)
 		return -ENOMEM;
-- 
2.43.0