linux-kernel - [PATCH 01/10] ASoC: qcom: q6apm: fix array out of bounds on lpass ports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260205171411.34908-2-srinivas.kandagatla@oss.qualcomm.com>
Date: Thu,  5 Feb 2026 12:14:02 -0500
From: Srinivas Kandagatla <srinivas.kandagatla@....qualcomm.com>
To: broonie@...nel.org
Cc: lgirdwood@...il.com, robh@...nel.org, krzk+dt@...nel.org,
        cnor+dt@...nel.org, srini@...nel.org, perex@...ex.cz, tiwai@...e.com,
        alexey.klimov@...aro.org, mohammad.rafi.shaik@....qualcomm.com,
        quic_wcheng@...cinc.com, johan@...nel.org,
        dmitry.baryshkov@....qualcomm.com, konrad.dybcio@....qualcomm.com,
        linux-arm-msm@...r.kernel.org, linux-sound@...r.kernel.org,
        devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
        Srinivas Kandagatla <srinivas.kandagatla@....qualcomm.com>,
        Stable@...r.kernel.org
Subject: [PATCH 01/10] ASoC: qcom: q6apm: fix array out of bounds on lpass ports

lpass ports numbers have been added but the apm driver never got updated
with new max port value that it uses to store dai specific data.

This will result in array out of bounds and weird driver behaviour.
Fix this by adding a new LPASS_MAX_PORT which is can be used by driver
instead of using number and any new port additional can only be done in
one place, which should avoid these type of mistakes in future.

Also update the driver to use this LPASS_MAX_PORT.

Fixes: 55b5fb369c02 ("ASoC: dt-bindings: qcom,q6dsp-lpass-ports: Add USB_RX port")
Cc: Stable@...r.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@....qualcomm.com>
---
 include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h | 1 +
 sound/soc/qcom/lpass.h                             | 2 +-
 sound/soc/qcom/qdsp6/q6afe.h                       | 3 ++-
 sound/soc/qcom/qdsp6/q6apm.h                       | 2 +-
 4 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
index 6d1ce7f5da51..609bc278f726 100644
--- a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
+++ b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
@@ -140,6 +140,7 @@
 #define DISPLAY_PORT_RX_6	134
 #define DISPLAY_PORT_RX_7	135
 #define USB_RX			136
+#define LPASS_MAX_PORT		(USB_RX + 1)
 
 #define LPASS_CLK_ID_PRI_MI2S_IBIT	1
 #define LPASS_CLK_ID_PRI_MI2S_EBIT	2
diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h
index de3ec6f594c1..99b0b6651fad 100644
--- a/sound/soc/qcom/lpass.h
+++ b/sound/soc/qcom/lpass.h
@@ -17,7 +17,7 @@
 #include "lpass-hdmi.h"
 
 #define LPASS_AHBIX_CLOCK_FREQUENCY		131072000
-#define LPASS_MAX_PORTS			(DISPLAY_PORT_RX_7 + 1)
+#define LPASS_MAX_PORTS			(LPASS_MAX_PORT)
 #define LPASS_MAX_MI2S_PORTS			(8)
 #define LPASS_MAX_DMA_CHANNELS			(8)
 #define LPASS_MAX_HDMI_DMA_CHANNELS		(4)
diff --git a/sound/soc/qcom/qdsp6/q6afe.h b/sound/soc/qcom/qdsp6/q6afe.h
index a29abe4ce436..ce4b04da1730 100644
--- a/sound/soc/qcom/qdsp6/q6afe.h
+++ b/sound/soc/qcom/qdsp6/q6afe.h
@@ -2,8 +2,9 @@
 
 #ifndef __Q6AFE_H__
 #define __Q6AFE_H__
+#include <dt-bindings/sound/qcom,q6afe.h>
 
-#define AFE_PORT_MAX		137
+#define AFE_PORT_MAX		LPASS_MAX_PORT
 
 #define MSM_AFE_PORT_TYPE_RX 0
 #define MSM_AFE_PORT_TYPE_TX 1
diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h
index 7ce08b401e31..189ed8a1a60d 100644
--- a/sound/soc/qcom/qdsp6/q6apm.h
+++ b/sound/soc/qcom/qdsp6/q6apm.h
@@ -16,7 +16,7 @@
 #include <linux/soc/qcom/apr.h>
 #include "audioreach.h"
 
-#define APM_PORT_MAX		127
+#define APM_PORT_MAX		LPASS_MAX_PORT
 #define APM_PORT_MAX_AUDIO_CHAN_CNT 8
 #define PCM_CHANNEL_NULL 0
 #define PCM_CHANNEL_FL    1	/* Front left channel. */
-- 
2.47.3