[PATCH] soundwire: bus: fix off-by-one when allocating slave IDs
From: Harshit Mogalapalli
Date: Sat Jan 10 2026 - 15:21:19 EST
ida_alloc_max() interprets its max argument as inclusive.
Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
allocated, but the IRQ domain created for the bus is sized for IDs
0-15. If 16 is returned, irq_create_mapping() fails and the driver
ends up with an invalid IRQ mapping.
Limit the allocation to 0-15 by passing SDW_FW_MAX_DEVICES - 1.
Reported-by: kernel test robot <lkp@xxxxxxxxx>
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Closes: https://lore.kernel.org/r/202512240450.hlDH3nCs-lkp@xxxxxxxxx/
Fixes: aab12022b076 ("soundwire: bus: Add internal slave ID and use for IRQs")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@xxxxxxxxxx>
---
Only compile tested.
---
drivers/soundwire/bus_type.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soundwire/bus_type.c b/drivers/soundwire/bus_type.c
index 80ed3468e860..a05aa36828cb 100644
--- a/drivers/soundwire/bus_type.c
+++ b/drivers/soundwire/bus_type.c
@@ -99,7 +99,7 @@ static int sdw_bus_probe(struct device *dev)
if (ret)
return ret;
- ret = ida_alloc_max(&slave->bus->slave_ida, SDW_FW_MAX_DEVICES, GFP_KERNEL);
+ ret = ida_alloc_max(&slave->bus->slave_ida, SDW_FW_MAX_DEVICES - 1, GFP_KERNEL);
if (ret < 0) {
dev_err(dev, "Failed to allocated ID: %d\n", ret);
return ret;
--
2.47.3