Unverified Commit 74a79977 authored by Krzysztof Kozlowski's avatar Krzysztof Kozlowski Committed by Mark Brown
Browse files

ASoC: codecs: wcd939x-sdw: Correct Soundwire ports mask 



Device has up to WCD939X_MAX_TX_SWR_PORTS (or WCD939X_MAX_RX_SWR_PORTS
for sink) number of ports and the array assigned to prop.src_dpn_prop
and prop.sink_dpn_prop has 0..WCD939X_MAX_TX_SWR_PORTS-1 elements.  On
the other hand, GENMASK(high, low) creates an inclusive mask between
<high, low>, so we need the mask from 0 up to WCD939X_MAX_TX_SWR_PORTS-1.

Theoretically, too wide mask could cause an out of bounds read in
sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy
driver, e.g. adding incorrect number of ports via
sdw_stream_add_slave().

Fixes: be2af391 ("ASoC: codecs: Add WCD939x Soundwire devices driver")
Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20240726-asoc-wcd-wsa-swr-ports-genmask-v1-3-d4d7a8b56f05@linaro.org


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 3f6fb03d

sound/soc/codecs/wcd939x-sdw.c

+2 −2
Original line number Diff line number Diff line
@@ -1453,12 +1453,12 @@ static int wcd9390_probe(struct sdw_slave *pdev, const struct sdw_device_id *id) 
	pdev->prop.lane_control_support = true;

	pdev->prop.simple_clk_stop_capable = true;

	if (wcd->is_tx) {

		pdev->prop.source_ports = GENMASK(WCD939X_MAX_TX_SWR_PORTS, 0);

		pdev->prop.source_ports = GENMASK(WCD939X_MAX_TX_SWR_PORTS - 1, 0);

		pdev->prop.src_dpn_prop = wcd939x_tx_dpn_prop;

		wcd->ch_info = &wcd939x_sdw_tx_ch_info[0];

		pdev->prop.wake_capable = true;

	} else {

		pdev->prop.sink_ports = GENMASK(WCD939X_MAX_RX_SWR_PORTS, 0);

		pdev->prop.sink_ports = GENMASK(WCD939X_MAX_RX_SWR_PORTS - 1, 0);

		pdev->prop.sink_dpn_prop = wcd939x_rx_dpn_prop;

		wcd->ch_info = &wcd939x_sdw_rx_ch_info[0];

	}