| Message ID | 20220701081908.248239-1-brent.lu@intel.com |
|---|---|
| State | Accepted |
| Commit | c7dab6745f4288af1e45d3809bf86a3778301616 |
| Headers | show |
| Series | ASoC: Intel: sof_rt5682: fix out-of-bounds array access | expand |
On 01/07/2022 11:19, Brent Lu wrote: > Starting from ADL platform we have four HDMI PCM devices which exceeds > the size of sof_hdmi array. Since each sof_hdmi_pcm structure > represents one HDMI PCM device, we remove the sof_hdmi array and add a > new member hdmi_jack to the snd_soc_jack structure to fix the "new member hdmi_jack to the sof_hdmi_pcm structure to fix the" > out-of-bounds problem. Other than that: Reviewed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> > Signed-off-by: Brent Lu <brent.lu@intel.com> > --- > sound/soc/intel/boards/sof_rt5682.c | 10 +++------- > 1 file changed, 3 insertions(+), 7 deletions(-) > > diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c > index a24fb71d5ff3..1384716c6360 100644 > --- a/sound/soc/intel/boards/sof_rt5682.c > +++ b/sound/soc/intel/boards/sof_rt5682.c > @@ -69,11 +69,10 @@ static unsigned long sof_rt5682_quirk = SOF_RT5682_MCLK_EN | > > static int is_legacy_cpu; > > -static struct snd_soc_jack sof_hdmi[3]; > - > struct sof_hdmi_pcm { > struct list_head head; > struct snd_soc_dai *codec_dai; > + struct snd_soc_jack hdmi_jack; > int device; > }; > > @@ -447,7 +446,6 @@ static int sof_card_late_probe(struct snd_soc_card *card) > char jack_name[NAME_SIZE]; > struct sof_hdmi_pcm *pcm; > int err; > - int i = 0; > > /* HDMI is not supported by SOF on Baytrail/CherryTrail */ > if (is_legacy_cpu || !ctx->idisp_codec) > @@ -468,17 +466,15 @@ static int sof_card_late_probe(struct snd_soc_card *card) > snprintf(jack_name, sizeof(jack_name), > "HDMI/DP, pcm=%d Jack", pcm->device); > err = snd_soc_card_jack_new(card, jack_name, > - SND_JACK_AVOUT, &sof_hdmi[i]); > + SND_JACK_AVOUT, &pcm->hdmi_jack); > > if (err) > return err; > > err = hdac_hdmi_jack_init(pcm->codec_dai, pcm->device, > - &sof_hdmi[i]); > + &pcm->hdmi_jack); > if (err < 0) > return err; > - > - i++; > } > > if (sof_rt5682_quirk & SOF_MAX98373_SPEAKER_AMP_PRESENT) {
On 7/1/22 03:19, Brent Lu wrote: > Starting from ADL platform we have four HDMI PCM devices which exceeds > the size of sof_hdmi array. Since each sof_hdmi_pcm structure > represents one HDMI PCM device, we remove the sof_hdmi array and add a > new member hdmi_jack to the snd_soc_jack structure to fix the > out-of-bounds problem. Valid fix aligned with other machine drivers, but the commit message is incorrect: the 4th HDMI link was added in TGL, not ADL. See e.g. 'Google Volteer', this quirk is already enabled: SOF_RT5682_NUM_HDMIDEV(4)), I guess existing topologies for Volteer never used the 4th link? Wondering how we didn't this problem sooner - and if this needs to be added to -stable, or if this is only needed for newer platforms. > Signed-off-by: Brent Lu <brent.lu@intel.com> > --- > sound/soc/intel/boards/sof_rt5682.c | 10 +++------- > 1 file changed, 3 insertions(+), 7 deletions(-) > > diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c > index a24fb71d5ff3..1384716c6360 100644 > --- a/sound/soc/intel/boards/sof_rt5682.c > +++ b/sound/soc/intel/boards/sof_rt5682.c > @@ -69,11 +69,10 @@ static unsigned long sof_rt5682_quirk = SOF_RT5682_MCLK_EN | > > static int is_legacy_cpu; > > -static struct snd_soc_jack sof_hdmi[3]; > - > struct sof_hdmi_pcm { > struct list_head head; > struct snd_soc_dai *codec_dai; > + struct snd_soc_jack hdmi_jack; > int device; > }; > > @@ -447,7 +446,6 @@ static int sof_card_late_probe(struct snd_soc_card *card) > char jack_name[NAME_SIZE]; > struct sof_hdmi_pcm *pcm; > int err; > - int i = 0; > > /* HDMI is not supported by SOF on Baytrail/CherryTrail */ > if (is_legacy_cpu || !ctx->idisp_codec) > @@ -468,17 +466,15 @@ static int sof_card_late_probe(struct snd_soc_card *card) > snprintf(jack_name, sizeof(jack_name), > "HDMI/DP, pcm=%d Jack", pcm->device); > err = snd_soc_card_jack_new(card, jack_name, > - SND_JACK_AVOUT, &sof_hdmi[i]); > + SND_JACK_AVOUT, &pcm->hdmi_jack); > > if (err) > return err; > > err = hdac_hdmi_jack_init(pcm->codec_dai, pcm->device, > - &sof_hdmi[i]); > + &pcm->hdmi_jack); > if (err < 0) > return err; > - > - i++; > } > > if (sof_rt5682_quirk & SOF_MAX98373_SPEAKER_AMP_PRESENT) {
> On 01/07/2022 11:19, Brent Lu wrote: > > Starting from ADL platform we have four HDMI PCM devices which exceeds > > the size of sof_hdmi array. Since each sof_hdmi_pcm structure > > represents one HDMI PCM device, we remove the sof_hdmi array and add a > > new member hdmi_jack to the snd_soc_jack structure to fix the > > "new member hdmi_jack to the sof_hdmi_pcm structure to fix the" > > > out-of-bounds problem. > > Other than that: > Reviewed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> > Thanks for the review. Will fix it in V2 patch. Brent
diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c index a24fb71d5ff3..1384716c6360 100644 --- a/sound/soc/intel/boards/sof_rt5682.c +++ b/sound/soc/intel/boards/sof_rt5682.c @@ -69,11 +69,10 @@ static unsigned long sof_rt5682_quirk = SOF_RT5682_MCLK_EN | static int is_legacy_cpu; -static struct snd_soc_jack sof_hdmi[3]; - struct sof_hdmi_pcm { struct list_head head; struct snd_soc_dai *codec_dai; + struct snd_soc_jack hdmi_jack; int device; }; @@ -447,7 +446,6 @@ static int sof_card_late_probe(struct snd_soc_card *card) char jack_name[NAME_SIZE]; struct sof_hdmi_pcm *pcm; int err; - int i = 0; /* HDMI is not supported by SOF on Baytrail/CherryTrail */ if (is_legacy_cpu || !ctx->idisp_codec) @@ -468,17 +466,15 @@ static int sof_card_late_probe(struct snd_soc_card *card) snprintf(jack_name, sizeof(jack_name), "HDMI/DP, pcm=%d Jack", pcm->device); err = snd_soc_card_jack_new(card, jack_name, - SND_JACK_AVOUT, &sof_hdmi[i]); + SND_JACK_AVOUT, &pcm->hdmi_jack); if (err) return err; err = hdac_hdmi_jack_init(pcm->codec_dai, pcm->device, - &sof_hdmi[i]); + &pcm->hdmi_jack); if (err < 0) return err; - - i++; } if (sof_rt5682_quirk & SOF_MAX98373_SPEAKER_AMP_PRESENT) {
Starting from ADL platform we have four HDMI PCM devices which exceeds the size of sof_hdmi array. Since each sof_hdmi_pcm structure represents one HDMI PCM device, we remove the sof_hdmi array and add a new member hdmi_jack to the snd_soc_jack structure to fix the out-of-bounds problem. Signed-off-by: Brent Lu <brent.lu@intel.com> --- sound/soc/intel/boards/sof_rt5682.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)