Hi,
On 10/09/2024 15:40, Peter Ujfalusi wrote:
The prop->src_dpn_prop and prop.sink_dpn_prop is allocated for the _number_ of ports and it is forced as 0 index based.
The original code was correct while the change to walk the bits and use their position as index into the arrays is not correct.
For exmple we can have the prop.source_ports=0x2, which means we have one port, but the prop.src_dpn_prop[1] is accessing outside of the allocated memory.
This reverts commit 6fa78e9c41471fe43052cd6feba6eae1b0277ae3.
I just noticed that Krzysztof already sent the revert patch but it is not picked up for stable-6.10.y
https://lore.kernel.org/lkml/20240909164746.136629-1-krzysztof.kozlowski@lin...
Cc: stable@vger.kernel.org # 6.10.y Signed-off-by: Peter Ujfalusi peter.ujfalusi@linux.intel.com
Hi,
The reverted patch causes major regression on soundwire causing all audio to fail. Interestingly the patch is only in 6.10.8 and 6.10.9, not in mainline or linux-next.
soundwire sdw-master-0-1: Program transport params failed: -22 soundwire sdw-master-0-1: Program params failed: -22 SDW1-Playback: ASoC: error at snd_soc_link_prepare on SDW1-Playback: -22
Regards, Peter
drivers/soundwire/stream.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c index 00191b1d2260..4e9e7d2a942d 100644 --- a/drivers/soundwire/stream.c +++ b/drivers/soundwire/stream.c @@ -1286,18 +1286,18 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_prop(struct sdw_slave *slave, unsigned int port_num) { struct sdw_dpn_prop *dpn_prop;
- unsigned long mask;
u8 num_ports; int i;
if (direction == SDW_DATA_DIR_TX) {
mask = slave->prop.source_ports;
num_ports = hweight32(slave->prop.source_ports);
mask = slave->prop.sink_ports;
num_ports = hweight32(slave->prop.sink_ports);
- for_each_set_bit(i, &mask, 32) {
- for (i = 0; i < num_ports; i++) { if (dpn_prop[i].num == port_num) return &dpn_prop[i]; }