ASoC: amd: acp-sdw-sof: Bound DAI link iteration

create_sdw_dailinks() walks sof_dais until it finds an entry with
initialised cleared, but sof_dais is allocated with exactly num_ends
entries. If all entries are initialised, the loop reads past the end of
the array.

Pass the allocated entry count to create_sdw_dailinks() and stop before
reading past the array.

Fixes: 6d8348ddc56e ("ASoC: amd: acp: refactor SoundWire machine driver code")
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Link: https://patch.msgid.link/20260528082110.915549-2-aaron.ma@canonical.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/amd/acp/acp-sdw-sof-mach.c b/sound/soc/amd/acp/acp-sdw-sof-mach.c
index a0fd8a6f99708878a3f72e7e4894c9456adb108b..a423853f3a97d8eeb41c61992c8e66a534bfce99 100644 (file)
--- a/sound/soc/amd/acp/acp-sdw-sof-mach.c
+++ b/sound/soc/amd/acp/acp-sdw-sof-mach.c
@@ -220,13 +220,14 @@ static int create_sdw_dailink(struct snd_soc_card *card,
 
 static int create_sdw_dailinks(struct snd_soc_card *card,
                               struct snd_soc_dai_link **dai_links, int *be_id,
-                              struct asoc_sdw_dailink *sof_dais,
+                              struct asoc_sdw_dailink *sof_dais, int num_dais,
                               struct snd_soc_codec_conf **codec_conf)
 {
+       int i;
        int ret;
 
        /* generate DAI links by each sdw link */
-       while (sof_dais->initialised) {
+       for (i = 0; i < num_dais && sof_dais->initialised; i++) {
                int current_be_id = 0;
 
                ret = create_sdw_dailink(card, sof_dais, dai_links,
@@ -334,7 +335,7 @@ static int sof_card_dai_links_create(struct snd_soc_card *card)
        /* SDW */
        if (sdw_be_num) {
                ret = create_sdw_dailinks(card, &dai_links, &be_id,
-                                         sof_dais, &codec_conf);
+                                         sof_dais, num_ends, &codec_conf);
                if (ret)
                        return ret;
        }