ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

create_sdw_dailinks() walks soc_dais until it finds an entry with
initialised cleared, but soc_dais is allocated with exactly num_ends
entries. If all entries are initialised, the loop reads past the end of
the array.

This was reported by KASAN:

  BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach]
  Read of size 1

Pass the allocated entry count to create_sdw_dailinks() and stop before
reading past the array.

Fixes: 2981d9b0789c ("ASoC: amd: acp: add soundwire machine driver for legacy stack")
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Link: https://patch.msgid.link/20260528082110.915549-1-aaron.ma@canonical.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/amd/acp/acp-sdw-legacy-mach.c b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
index 09b475c83c4966a3094ad788abd9477b3f60ae4f..e8b6819cc4b4590034d8222f4985c725405ab6eb 100644 (file)
--- a/sound/soc/amd/acp/acp-sdw-legacy-mach.c
+++ b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
@@ -303,13 +303,14 @@ static int create_sdw_dailink(struct snd_soc_card *card,
 
 static int create_sdw_dailinks(struct snd_soc_card *card,
                               struct snd_soc_dai_link **dai_links, int *be_id,
-                              struct asoc_sdw_dailink *soc_dais,
+                              struct asoc_sdw_dailink *soc_dais, int num_dais,
                               struct snd_soc_codec_conf **codec_conf)
 {
        struct device *dev = card->dev;
        struct asoc_sdw_mc_private *ctx = snd_soc_card_get_drvdata(card);
        struct amd_mc_ctx *amd_ctx = (struct amd_mc_ctx *)ctx->private;
        struct snd_soc_dai_link_component *sdw_platform_component;
+       int i;
        int ret;
 
        sdw_platform_component = devm_kzalloc(dev, sizeof(struct snd_soc_dai_link_component),
@@ -329,7 +330,7 @@ static int create_sdw_dailinks(struct snd_soc_card *card,
        }
 
        /* generate DAI links by each sdw link */
-       while (soc_dais->initialised) {
+       for (i = 0; i < num_dais && soc_dais->initialised; i++) {
                int current_be_id = 0;
 
                ret = create_sdw_dailink(card, soc_dais, dai_links,
@@ -463,7 +464,7 @@ static int soc_card_dai_links_create(struct snd_soc_card *card)
        /* SDW */
        if (sdw_be_num) {
                ret = create_sdw_dailinks(card, &dai_links, &be_id,
-                                         soc_dais, &codec_conf);
+                                         soc_dais, num_ends, &codec_conf);
                if (ret)
                        return ret;
        }