]> git.ipfire.org Git - thirdparty/linux.git/commit
ASoC: amd: acp-sdw-legacy: Bound DAI link iteration
authorAaron Ma <aaron.ma@canonical.com>
Thu, 28 May 2026 08:21:09 +0000 (16:21 +0800)
committerMark Brown <broonie@kernel.org>
Mon, 8 Jun 2026 18:13:04 +0000 (19:13 +0100)
commitd49ecdf327cc91062d2f80996a163cf65fda1e60
treeb4cd2005a796f0c9ec5826b0e264da99865b956e
parent3b28b14b794cb95427028d55122eeff0787315ca
ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

create_sdw_dailinks() walks soc_dais until it finds an entry with
initialised cleared, but soc_dais is allocated with exactly num_ends
entries. If all entries are initialised, the loop reads past the end of
the array.

This was reported by KASAN:

  BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach]
  Read of size 1

Pass the allocated entry count to create_sdw_dailinks() and stop before
reading past the array.

Fixes: 2981d9b0789c ("ASoC: amd: acp: add soundwire machine driver for legacy stack")
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Link: https://patch.msgid.link/20260528082110.915549-1-aaron.ma@canonical.com
Signed-off-by: Mark Brown <broonie@kernel.org>
sound/soc/amd/acp/acp-sdw-legacy-mach.c