2022-07-01 08:49:18

by Brent Lu

[permalink] [raw]
Subject: [PATCH] ASoC: Intel: sof_rt5682: fix out-of-bounds array access

Starting from ADL platform we have four HDMI PCM devices which exceeds
the size of sof_hdmi array. Since each sof_hdmi_pcm structure
represents one HDMI PCM device, we remove the sof_hdmi array and add a
new member hdmi_jack to the snd_soc_jack structure to fix the
out-of-bounds problem.

Signed-off-by: Brent Lu <[email protected]>
---
sound/soc/intel/boards/sof_rt5682.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
index a24fb71d5ff3..1384716c6360 100644
--- a/sound/soc/intel/boards/sof_rt5682.c
+++ b/sound/soc/intel/boards/sof_rt5682.c
@@ -69,11 +69,10 @@ static unsigned long sof_rt5682_quirk = SOF_RT5682_MCLK_EN |

static int is_legacy_cpu;

-static struct snd_soc_jack sof_hdmi[3];
-
struct sof_hdmi_pcm {
struct list_head head;
struct snd_soc_dai *codec_dai;
+ struct snd_soc_jack hdmi_jack;
int device;
};

@@ -447,7 +446,6 @@ static int sof_card_late_probe(struct snd_soc_card *card)
char jack_name[NAME_SIZE];
struct sof_hdmi_pcm *pcm;
int err;
- int i = 0;

/* HDMI is not supported by SOF on Baytrail/CherryTrail */
if (is_legacy_cpu || !ctx->idisp_codec)
@@ -468,17 +466,15 @@ static int sof_card_late_probe(struct snd_soc_card *card)
snprintf(jack_name, sizeof(jack_name),
"HDMI/DP, pcm=%d Jack", pcm->device);
err = snd_soc_card_jack_new(card, jack_name,
- SND_JACK_AVOUT, &sof_hdmi[i]);
+ SND_JACK_AVOUT, &pcm->hdmi_jack);

if (err)
return err;

err = hdac_hdmi_jack_init(pcm->codec_dai, pcm->device,
- &sof_hdmi[i]);
+ &pcm->hdmi_jack);
if (err < 0)
return err;
-
- i++;
}

if (sof_rt5682_quirk & SOF_MAX98373_SPEAKER_AMP_PRESENT) {
--
2.25.1


2022-07-01 11:26:18

by Péter Ujfalusi

[permalink] [raw]
Subject: Re: [PATCH] ASoC: Intel: sof_rt5682: fix out-of-bounds array access



On 01/07/2022 11:19, Brent Lu wrote:
> Starting from ADL platform we have four HDMI PCM devices which exceeds
> the size of sof_hdmi array. Since each sof_hdmi_pcm structure
> represents one HDMI PCM device, we remove the sof_hdmi array and add a
> new member hdmi_jack to the snd_soc_jack structure to fix the

"new member hdmi_jack to the sof_hdmi_pcm structure to fix the"

> out-of-bounds problem.

Other than that:
Reviewed-by: Peter Ujfalusi <[email protected]>

> Signed-off-by: Brent Lu <[email protected]>
> ---
> sound/soc/intel/boards/sof_rt5682.c | 10 +++-------
> 1 file changed, 3 insertions(+), 7 deletions(-)
>
> diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
> index a24fb71d5ff3..1384716c6360 100644
> --- a/sound/soc/intel/boards/sof_rt5682.c
> +++ b/sound/soc/intel/boards/sof_rt5682.c
> @@ -69,11 +69,10 @@ static unsigned long sof_rt5682_quirk = SOF_RT5682_MCLK_EN |
>
> static int is_legacy_cpu;
>
> -static struct snd_soc_jack sof_hdmi[3];
> -
> struct sof_hdmi_pcm {
> struct list_head head;
> struct snd_soc_dai *codec_dai;
> + struct snd_soc_jack hdmi_jack;
> int device;
> };
>
> @@ -447,7 +446,6 @@ static int sof_card_late_probe(struct snd_soc_card *card)
> char jack_name[NAME_SIZE];
> struct sof_hdmi_pcm *pcm;
> int err;
> - int i = 0;
>
> /* HDMI is not supported by SOF on Baytrail/CherryTrail */
> if (is_legacy_cpu || !ctx->idisp_codec)
> @@ -468,17 +466,15 @@ static int sof_card_late_probe(struct snd_soc_card *card)
> snprintf(jack_name, sizeof(jack_name),
> "HDMI/DP, pcm=%d Jack", pcm->device);
> err = snd_soc_card_jack_new(card, jack_name,
> - SND_JACK_AVOUT, &sof_hdmi[i]);
> + SND_JACK_AVOUT, &pcm->hdmi_jack);
>
> if (err)
> return err;
>
> err = hdac_hdmi_jack_init(pcm->codec_dai, pcm->device,
> - &sof_hdmi[i]);
> + &pcm->hdmi_jack);
> if (err < 0)
> return err;
> -
> - i++;
> }
>
> if (sof_rt5682_quirk & SOF_MAX98373_SPEAKER_AMP_PRESENT) {

--
Péter

2022-07-01 14:30:53

by Brent Lu

[permalink] [raw]
Subject: RE: [PATCH] ASoC: Intel: sof_rt5682: fix out-of-bounds array access

> On 01/07/2022 11:19, Brent Lu wrote:
> > Starting from ADL platform we have four HDMI PCM devices which exceeds
> > the size of sof_hdmi array. Since each sof_hdmi_pcm structure
> > represents one HDMI PCM device, we remove the sof_hdmi array and add a
> > new member hdmi_jack to the snd_soc_jack structure to fix the
>
> "new member hdmi_jack to the sof_hdmi_pcm structure to fix the"
>
> > out-of-bounds problem.
>
> Other than that:
> Reviewed-by: Peter Ujfalusi <[email protected]>
>

Thanks for the review. Will fix it in V2 patch.

Brent

2022-07-01 15:25:16

by Pierre-Louis Bossart

[permalink] [raw]
Subject: Re: [PATCH] ASoC: Intel: sof_rt5682: fix out-of-bounds array access



On 7/1/22 03:19, Brent Lu wrote:
> Starting from ADL platform we have four HDMI PCM devices which exceeds
> the size of sof_hdmi array. Since each sof_hdmi_pcm structure
> represents one HDMI PCM device, we remove the sof_hdmi array and add a
> new member hdmi_jack to the snd_soc_jack structure to fix the
> out-of-bounds problem.

Valid fix aligned with other machine drivers, but the commit message is
incorrect: the 4th HDMI link was added in TGL, not ADL.

See e.g. 'Google Volteer', this quirk is already enabled:
SOF_RT5682_NUM_HDMIDEV(4)),

I guess existing topologies for Volteer never used the 4th link?

Wondering how we didn't this problem sooner - and if this needs to be
added to -stable, or if this is only needed for newer platforms.

> Signed-off-by: Brent Lu <[email protected]>
> ---
> sound/soc/intel/boards/sof_rt5682.c | 10 +++-------
> 1 file changed, 3 insertions(+), 7 deletions(-)
>
> diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
> index a24fb71d5ff3..1384716c6360 100644
> --- a/sound/soc/intel/boards/sof_rt5682.c
> +++ b/sound/soc/intel/boards/sof_rt5682.c
> @@ -69,11 +69,10 @@ static unsigned long sof_rt5682_quirk = SOF_RT5682_MCLK_EN |
>
> static int is_legacy_cpu;
>
> -static struct snd_soc_jack sof_hdmi[3];
> -
> struct sof_hdmi_pcm {
> struct list_head head;
> struct snd_soc_dai *codec_dai;
> + struct snd_soc_jack hdmi_jack;
> int device;
> };
>
> @@ -447,7 +446,6 @@ static int sof_card_late_probe(struct snd_soc_card *card)
> char jack_name[NAME_SIZE];
> struct sof_hdmi_pcm *pcm;
> int err;
> - int i = 0;
>
> /* HDMI is not supported by SOF on Baytrail/CherryTrail */
> if (is_legacy_cpu || !ctx->idisp_codec)
> @@ -468,17 +466,15 @@ static int sof_card_late_probe(struct snd_soc_card *card)
> snprintf(jack_name, sizeof(jack_name),
> "HDMI/DP, pcm=%d Jack", pcm->device);
> err = snd_soc_card_jack_new(card, jack_name,
> - SND_JACK_AVOUT, &sof_hdmi[i]);
> + SND_JACK_AVOUT, &pcm->hdmi_jack);
>
> if (err)
> return err;
>
> err = hdac_hdmi_jack_init(pcm->codec_dai, pcm->device,
> - &sof_hdmi[i]);
> + &pcm->hdmi_jack);
> if (err < 0)
> return err;
> -
> - i++;
> }
>
> if (sof_rt5682_quirk & SOF_MAX98373_SPEAKER_AMP_PRESENT) {