[alsa-devel] [PATCH] ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug

[Pierre-Louis Bossart]

On 1/22/20 12:12 PM, Cezary Rojewski wrote:
> Definitions for idisp snd_soc_dai_links within skl_hda_dsp_common are
> missing platform component. Add it to address following bug reported by
> KASAN:
> 
> [   10.538502] BUG: KASAN: global-out-of-bounds in skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp]
> [   10.538509] Write of size 8 at addr ffffffffc0606840 by task systemd-udevd/299
> (...)

You could probably skip the call trace, it doesn't really provide much 
information.

Kai and Ranjani, do you think this impacts SOF as well? Or does our BE 
override somehow suppresses the problem?

>   sound/soc/intel/boards/skl_hda_dsp_common.c | 21 ++++++++++++---------
>   1 file changed, 12 insertions(+), 9 deletions(-)
> 
> diff --git a/sound/soc/intel/boards/skl_hda_dsp_common.c b/sound/soc/intel/boards/skl_hda_dsp_common.c
> index eb419e1ec42b..78ff5f24c40e 100644
> --- a/sound/soc/intel/boards/skl_hda_dsp_common.c
> +++ b/sound/soc/intel/boards/skl_hda_dsp_common.c
> @@ -41,16 +41,19 @@ int skl_hda_hdmi_add_pcm(struct snd_soc_card *card, int device)
>   	return 0;
>   }
>   
> -SND_SOC_DAILINK_DEFS(idisp1,
> -	DAILINK_COMP_ARRAY(COMP_CPU("iDisp1 Pin")),
> +SND_SOC_DAILINK_DEF(idisp1_cpu,
> +	DAILINK_COMP_ARRAY(COMP_CPU("iDisp1 Pin")));
> +SND_SOC_DAILINK_DEF(idisp1_codec,
>   	DAILINK_COMP_ARRAY(COMP_CODEC("ehdaudio0D2", "intel-hdmi-hifi1")));
>   
> -SND_SOC_DAILINK_DEFS(idisp2,
> -	DAILINK_COMP_ARRAY(COMP_CPU("iDisp2 Pin")),
> +SND_SOC_DAILINK_DEF(idisp2_cpu,
> +	DAILINK_COMP_ARRAY(COMP_CPU("iDisp2 Pin")));
> +SND_SOC_DAILINK_DEF(idisp2_codec,
>   	DAILINK_COMP_ARRAY(COMP_CODEC("ehdaudio0D2", "intel-hdmi-hifi2")));
>   
> -SND_SOC_DAILINK_DEFS(idisp3,
> -	DAILINK_COMP_ARRAY(COMP_CPU("iDisp3 Pin")),
> +SND_SOC_DAILINK_DEF(idisp3_cpu,
> +	DAILINK_COMP_ARRAY(COMP_CPU("iDisp3 Pin")));
> +SND_SOC_DAILINK_DEF(idisp3_codec,
>   	DAILINK_COMP_ARRAY(COMP_CODEC("ehdaudio0D2", "intel-hdmi-hifi3")));
>   
>   SND_SOC_DAILINK_DEF(analog_cpu,
> @@ -83,21 +86,21 @@ struct snd_soc_dai_link skl_hda_be_dai_links[HDA_DSP_MAX_BE_DAI_LINKS] = {
>   		.id = 1,
>   		.dpcm_playback = 1,
>   		.no_pcm = 1,
> -		SND_SOC_DAILINK_REG(idisp1),
> +		SND_SOC_DAILINK_REG(idisp1_cpu, idisp1_codec, platform),
>   	},
>   	{
>   		.name = "iDisp2",
>   		.id = 2,
>   		.dpcm_playback = 1,
>   		.no_pcm = 1,
> -		SND_SOC_DAILINK_REG(idisp2),
> +		SND_SOC_DAILINK_REG(idisp2_cpu, idisp2_codec, platform),
>   	},
>   	{
>   		.name = "iDisp3",
>   		.id = 3,
>   		.dpcm_playback = 1,
>   		.no_pcm = 1,
> -		SND_SOC_DAILINK_REG(idisp3),
> +		SND_SOC_DAILINK_REG(idisp3_cpu, idisp3_codec, platform),
>   	},
>   	{
>   		.name = "Analog Playback and Capture",
>