Commit aebb1813 authored by Krzysztof Kozlowski's avatar Krzysztof Kozlowski Committed by Mark Brown

ASoC: codecs: wcd937x-sdw: Correct Soundwire ports mask

Device has up to WCD937X_MAX_TX_SWR_PORTS (or WCD937X_MAX_SWR_PORTS
for sink) number of ports and the array assigned to prop.src_dpn_prop
and prop.sink_dpn_prop has 0..WCD937X_MAX_TX_SWR_PORTS-1 elements.  On
the other hand, GENMASK(high, low) creates an inclusive mask between
<high, low>, so we need the mask from 0 up to WCD937X_MAX_TX_SWR_PORTS-1.

Theoretically, too wide mask could cause an out of bounds read in
sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy
driver, e.g. adding incorrect number of ports via
sdw_stream_add_slave().

Fixes: c99a515f ("ASoC: codecs: wcd937x-sdw: add SoundWire driver")
Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20240726-asoc-wcd-wsa-swr-ports-genmask-v1-1-d4d7a8b56f05@linaro.orgSigned-off-by: default avatarMark Brown <broonie@kernel.org>
parent 8400291e
...@@ -1049,7 +1049,7 @@ static int wcd9370_probe(struct sdw_slave *pdev, ...@@ -1049,7 +1049,7 @@ static int wcd9370_probe(struct sdw_slave *pdev,
pdev->prop.lane_control_support = true; pdev->prop.lane_control_support = true;
pdev->prop.simple_clk_stop_capable = true; pdev->prop.simple_clk_stop_capable = true;
if (wcd->is_tx) { if (wcd->is_tx) {
pdev->prop.source_ports = GENMASK(WCD937X_MAX_TX_SWR_PORTS, 0); pdev->prop.source_ports = GENMASK(WCD937X_MAX_TX_SWR_PORTS - 1, 0);
pdev->prop.src_dpn_prop = wcd937x_dpn_prop; pdev->prop.src_dpn_prop = wcd937x_dpn_prop;
wcd->ch_info = &wcd937x_sdw_tx_ch_info[0]; wcd->ch_info = &wcd937x_sdw_tx_ch_info[0];
pdev->prop.wake_capable = true; pdev->prop.wake_capable = true;
...@@ -1062,7 +1062,7 @@ static int wcd9370_probe(struct sdw_slave *pdev, ...@@ -1062,7 +1062,7 @@ static int wcd9370_probe(struct sdw_slave *pdev,
/* Start in cache-only until device is enumerated */ /* Start in cache-only until device is enumerated */
regcache_cache_only(wcd->regmap, true); regcache_cache_only(wcd->regmap, true);
} else { } else {
pdev->prop.sink_ports = GENMASK(WCD937X_MAX_SWR_PORTS, 0); pdev->prop.sink_ports = GENMASK(WCD937X_MAX_SWR_PORTS - 1, 0);
pdev->prop.sink_dpn_prop = wcd937x_dpn_prop; pdev->prop.sink_dpn_prop = wcd937x_dpn_prop;
wcd->ch_info = &wcd937x_sdw_rx_ch_info[0]; wcd->ch_info = &wcd937x_sdw_rx_ch_info[0];
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment