Commit 4ef3f2af authored by Srinivas Kandagatla's avatar Srinivas Kandagatla Committed by Vinod Koul
Browse files

soundwire: qcom: fix device status array range 



This patch updates device status array range from 11 to 12 as we will
be reading status from device number 0 to device number 11 inclusive.

Without this patch we can potentially access status array out of range
during auto-enumeration.

Fixes: aa1262ca ("soundwire: qcom: Check device status before reading devid")
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20220708104747.8722-1-srinivas.kandagatla@linaro.org


Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
parent c6e50787

drivers/soundwire/qcom.c

+3 −3
Original line number Diff line number Diff line
@@ -169,7 +169,7 @@ struct qcom_swrm_ctrl { 
	u8 wcmd_id;

	struct qcom_swrm_port_config pconfig[QCOM_SDW_MAX_PORTS];

	struct sdw_stream_runtime *sruntime[SWRM_MAX_DAIS];

	enum sdw_slave_status status[SDW_MAX_DEVICES];

	enum sdw_slave_status status[SDW_MAX_DEVICES + 1];

	int (*reg_read)(struct qcom_swrm_ctrl *ctrl, int reg, u32 *val);

	int (*reg_write)(struct qcom_swrm_ctrl *ctrl, int reg, int val);

	u32 slave_status;
@@ -420,7 +420,7 @@ static int qcom_swrm_get_alert_slave_dev_num(struct qcom_swrm_ctrl *ctrl) 


	ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val);



	for (dev_num = 0; dev_num < SDW_MAX_DEVICES; dev_num++) {

	for (dev_num = 0; dev_num <= SDW_MAX_DEVICES; dev_num++) {

		status = (val >> (dev_num * SWRM_MCP_SLV_STATUS_SZ));



		if ((status & SWRM_MCP_SLV_STATUS_MASK) == SDW_SLAVE_ALERT) {
@@ -440,7 +440,7 @@ static void qcom_swrm_get_device_status(struct qcom_swrm_ctrl *ctrl) 
	ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val);

	ctrl->slave_status = val;



	for (i = 0; i < SDW_MAX_DEVICES; i++) {

	for (i = 0; i <= SDW_MAX_DEVICES; i++) {

		u32 s;



		s = (val >> (i * 2));