[PATCH v2 06/10] soundwire: qcom: Prevent pconfig buffer overflow in qcom_swrm_stream_alloc_ports()
From: Lee Jones
Date: Tue Nov 03 2026 - 05:20:43 EST
qcom_swrm_stream_alloc_ports() allocates the pconfig array with
ctrl->nports elements, but only checks that the assigned port number pn
is below maxport. When multiple slave ports map to the same master port
via m_port_map or the stream requests more slave ports than
ctrl->nports, nports increments past ctrl->nports and writes out of
bounds of pconfig.
Verify that nports is less than maxport before writing to
pconfig[nports], and clear any port_mask bits allocated during the loop
before returning -EBUSY.
Closes: https://sashiko.dev/#/bug/linux-543ea0c0-a6e5-4b03-a041-ea0a760802c1
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
v1 => v2:
- Also check nports >= maxport and clear allocated port_mask bits on error
- Drop Fixes and Stable tags
drivers/soundwire/qcom.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
index 6e0c5fb10efa..29130745c809 100644
--- a/drivers/soundwire/qcom.c
+++ b/drivers/soundwire/qcom.c
@@ -1350,8 +1350,10 @@ static int qcom_swrm_stream_alloc_ports(struct qcom_swrm_ctrl *ctrl,
else
pn = find_first_zero_bit(port_mask, maxport);
- if (pn >= maxport) {
+ if (pn >= maxport || nports >= maxport) {
dev_err(ctrl->dev, "All ports busy\n");
+ while (nports--)
+ clear_bit(pconfig[nports].num, port_mask);
return -EBUSY;
}
set_bit(pn, port_mask);
--
2.56.0.385.gac671c819a-goog