mbox series

[0/6] ASoC: codecs: wcd93xx/wsa88xx: Correct Soundwire ports mask

Message ID 20240726-asoc-wcd-wsa-swr-ports-genmask-v1-0-d4d7a8b56f05@linaro.org
Headers show
Series ASoC: codecs: wcd93xx/wsa88xx: Correct Soundwire ports mask | expand

Message

Krzysztof Kozlowski July 26, 2024, 2:10 p.m. UTC
Hi,

Incorrect mask of Soundwire ports - one bit too long/big - was passed.

Theoretically, too wide mask could cause an out of bounds read in
sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy
driver, e.g. adding incorrect number of ports via
sdw_stream_add_slave().

Not adding Cc-stable because I don't think the issue can lead to real
out-of-bounds read.

Best regards,
Krzysztof

---
Krzysztof Kozlowski (6):
      ASoC: codecs: wcd937x-sdw: Correct Soundwire ports mask
      ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
      ASoC: codecs: wcd939x-sdw: Correct Soundwire ports mask
      ASoC: codecs: wsa881x: Correct Soundwire ports mask
      ASoC: codecs: wsa883x: Correct Soundwire ports mask
      ASoC: codecs: wsa884x: Correct Soundwire ports mask

 sound/soc/codecs/wcd937x-sdw.c | 4 ++--
 sound/soc/codecs/wcd938x-sdw.c | 4 ++--
 sound/soc/codecs/wcd939x-sdw.c | 4 ++--
 sound/soc/codecs/wsa881x.c     | 2 +-
 sound/soc/codecs/wsa883x.c     | 2 +-
 sound/soc/codecs/wsa884x.c     | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)
---
base-commit: 864b1099d16fc7e332c3ad7823058c65f890486c
change-id: 20240726-asoc-wcd-wsa-swr-ports-genmask-868239f9682f

Best regards,

Comments

Dmitry Baryshkov July 27, 2024, 10:55 a.m. UTC | #1
On Fri, Jul 26, 2024 at 04:10:40PM GMT, Krzysztof Kozlowski wrote:
> Hi,
> 
> Incorrect mask of Soundwire ports - one bit too long/big - was passed.
> 
> Theoretically, too wide mask could cause an out of bounds read in
> sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy
> driver, e.g. adding incorrect number of ports via
> sdw_stream_add_slave().

Well, granted that sdw_stream_add_slave() crashes on RB3, we know that
the driver is buggy.

> Not adding Cc-stable because I don't think the issue can lead to real
> out-of-bounds read.
Mark Brown July 29, 2024, 7:37 p.m. UTC | #2
On Fri, 26 Jul 2024 16:10:40 +0200, Krzysztof Kozlowski wrote:
> Incorrect mask of Soundwire ports - one bit too long/big - was passed.
> 
> Theoretically, too wide mask could cause an out of bounds read in
> sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy
> driver, e.g. adding incorrect number of ports via
> sdw_stream_add_slave().
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next

Thanks!

[1/6] ASoC: codecs: wcd937x-sdw: Correct Soundwire ports mask
      commit: aebb1813c279ce8f3a2dfa3f86def0c0ec1cbb8d
[2/6] ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
      commit: 3f6fb03dae9c7dfba7670858d29e03c8faaa89fe
[3/6] ASoC: codecs: wcd939x-sdw: Correct Soundwire ports mask
      commit: 74a79977c4e1d09eced33e6e22f875a5bb3fad29
[4/6] ASoC: codecs: wsa881x: Correct Soundwire ports mask
      commit: eb11c3bb64ad0a05aeacdb01039863aa2aa3614b
[5/6] ASoC: codecs: wsa883x: Correct Soundwire ports mask
      commit: 6801ac36f25690e14955f7f9eace1eaa29edbdd0
[6/6] ASoC: codecs: wsa884x: Correct Soundwire ports mask
      commit: dcb6631d05152930e2ea70fd2abfd811b0e970b5

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark