Skip to content

Commit 490937d

Browse files
krzkvinodkoul
authored andcommitted
soundwire: qcom: fix storing port config out-of-bounds
The 'qcom_swrm_ctrl->pconfig' has size of QCOM_SDW_MAX_PORTS (14), however we index it starting from 1, not 0, to match real port numbers. This can lead to writing port config past 'pconfig' bounds and overwriting next member of 'qcom_swrm_ctrl' struct. Reported also by smatch: drivers/soundwire/qcom.c:1269 qcom_swrm_get_port_config() error: buffer overflow 'ctrl->pconfig' 14 <= 14 Fixes: 9916c02 ("soundwire: qcom: cleanup internal port config indexing") Cc: <stable@vger.kernel.org> Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Link: https://lore.kernel.org/r/202305201301.sCJ8UDKV-lkp@intel.com/ Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Link: https://lore.kernel.org/r/20230601102525.609627-1-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
1 parent a1b828f commit 490937d

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

drivers/soundwire/qcom.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,8 @@ struct qcom_swrm_ctrl {
202202
u32 intr_mask;
203203
u8 rcmd_id;
204204
u8 wcmd_id;
205-
struct qcom_swrm_port_config pconfig[QCOM_SDW_MAX_PORTS];
205+
/* Port numbers are 1 - 14 */
206+
struct qcom_swrm_port_config pconfig[QCOM_SDW_MAX_PORTS + 1];
206207
struct sdw_stream_runtime *sruntime[SWRM_MAX_DAIS];
207208
enum sdw_slave_status status[SDW_MAX_DEVICES + 1];
208209
int (*reg_read)(struct qcom_swrm_ctrl *ctrl, int reg, u32 *val);

0 commit comments

Comments
 (0)