Re: [PATCH] ASoC: Intel: sof_rt5682: fix out-of-bounds array access

On 7/1/22 03:19, Brent Lu wrote:

Starting from ADL platform we have four HDMI PCM devices which exceeds the size of sof_hdmi array. Since each sof_hdmi_pcm structure represents one HDMI PCM device, we remove the sof_hdmi array and add a new member hdmi_jack to the snd_soc_jack structure to fix the out-of-bounds problem.

Valid fix aligned with other machine drivers, but the commit message is incorrect: the 4th HDMI link was added in TGL, not ADL.

See e.g. 'Google Volteer', this quirk is already enabled: SOF_RT5682_NUM_HDMIDEV(4)),

I guess existing topologies for Volteer never used the 4th link?

Wondering how we didn't this problem sooner - and if this needs to be added to -stable, or if this is only needed for newer platforms.

Signed-off-by: Brent Lu brent.lu@intel.com

sound/soc/intel/boards/sof_rt5682.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c index a24fb71d5ff3..1384716c6360 100644 --- a/sound/soc/intel/boards/sof_rt5682.c +++ b/sound/soc/intel/boards/sof_rt5682.c @@ -69,11 +69,10 @@ static unsigned long sof_rt5682_quirk = SOF_RT5682_MCLK_EN |

static int is_legacy_cpu;

-static struct snd_soc_jack sof_hdmi[3];

struct sof_hdmi_pcm { struct list_head head; struct snd_soc_dai *codec_dai;

• struct snd_soc_jack hdmi_jack; int device;

};

@@ -447,7 +446,6 @@ static int sof_card_late_probe(struct snd_soc_card *card) char jack_name[NAME_SIZE]; struct sof_hdmi_pcm *pcm; int err;

• int i = 0;

  /* HDMI is not supported by SOF on Baytrail/CherryTrail */ if (is_legacy_cpu || !ctx->idisp_codec)

@@ -468,17 +466,15 @@ static int sof_card_late_probe(struct snd_soc_card *card) snprintf(jack_name, sizeof(jack_name), "HDMI/DP, pcm=%d Jack", pcm->device); err = snd_soc_card_jack_new(card, jack_name,

• 			    SND_JACK_AVOUT, &sof_hdmi[i]);
  

• 			    SND_JACK_AVOUT, &pcm->hdmi_jack);
  
  

  if (err) return err;

  err = hdac_hdmi_jack_init(pcm->codec_dai, pcm->device,

• 			  &sof_hdmi[i]);
  

• 			  &pcm->hdmi_jack);
  

  if (err < 0) return err;

• i++;
  

  }

  if (sof_rt5682_quirk & SOF_MAX98373_SPEAKER_AMP_PRESENT) {