| Message ID | 1032216f-902f-48f9-aa49-9d5ece8e87f2@moroto.mountain (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d685aea5e0a89b66679e5266320ab2ba4378c754 |
| Headers | show |
| Series | ASoC: audio-graph-card2: fix off by one in graph_parse_node_multi_nm() | expand |
Hi Dan > The > comparison should be >= to avoid writing one element beyond the end > of the dai_link->ch_maps[] array. The dai_link->ch_maps[] array is > allocated in graph_parse_node_multi() and it has "nm_max" elements. > > Fixes: e2de6808df4a ("ASoC: audio-graph-card2: add CPU:Codec = N:M support") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> > In this same function I was also concerned about these conditions: > > if (cpu_idx > dai_link->num_cpus) > if (codec_idx > dai_link->num_codecs) > > But I wasn't able to see out how those idx variables are actually > used. These also ">=" I think. Thank you for pointing it Best regards --- Renesas Electronics Ph.D. Kuninori Morimoto
On Mon, 04 Dec 2023 15:42:07 +0300, Dan Carpenter wrote: > The > comparison should be >= to avoid writing one element beyond the end > of the dai_link->ch_maps[] array. The dai_link->ch_maps[] array is > allocated in graph_parse_node_multi() and it has "nm_max" elements. > > Applied to https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next Thanks! [1/1] ASoC: audio-graph-card2: fix off by one in graph_parse_node_multi_nm() commit: d685aea5e0a89b66679e5266320ab2ba4378c754 All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark
diff --git a/sound/soc/generic/audio-graph-card2.c b/sound/soc/generic/audio-graph-card2.c index d9e10308a508..78d9679decda 100644 --- a/sound/soc/generic/audio-graph-card2.c +++ b/sound/soc/generic/audio-graph-card2.c @@ -557,7 +557,7 @@ static int graph_parse_node_multi_nm(struct snd_soc_dai_link *dai_link, struct device_node *mcodec_port; int codec_idx; - if (*nm_idx > nm_max) + if (*nm_idx >= nm_max) break; mcpu_ep_n = of_get_next_child(mcpu_port, mcpu_ep_n);
The > comparison should be >= to avoid writing one element beyond the end of the dai_link->ch_maps[] array. The dai_link->ch_maps[] array is allocated in graph_parse_node_multi() and it has "nm_max" elements. Fixes: e2de6808df4a ("ASoC: audio-graph-card2: add CPU:Codec = N:M support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- In this same function I was also concerned about these conditions: if (cpu_idx > dai_link->num_cpus) if (codec_idx > dai_link->num_codecs) But I wasn't able to see out how those idx variables are actually used. sound/soc/generic/audio-graph-card2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)