[alsa-devel] [PATCH] ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug

[Sridharan, Ranjani]

On Wed, Jan 22, 2020 at 11:58 AM Pierre-Louis Bossart <
pierre-louis.bossart at linux.intel.com> wrote:

>
>
> On 1/22/20 12:12 PM, Cezary Rojewski wrote:
> > Definitions for idisp snd_soc_dai_links within skl_hda_dsp_common are
> > missing platform component. Add it to address following bug reported by
> > KASAN:
> >
> > [   10.538502] BUG: KASAN: global-out-of-bounds in
> skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp]
> > [   10.538509] Write of size 8 at addr ffffffffc0606840 by task
> systemd-udevd/299
> > (...)
>
> You could probably skip the call trace, it doesn't really provide much
> information.
>
> Kai and Ranjani, do you think this impacts SOF as well? Or does our BE
> override somehow suppresses the problem?
>
Hi Pierre/Cezary,

SOF does have the same problem too but I thought we're allowed to have dai
links without platform component? An alternative to adding the platform
component would be to do something like below.

Thanks,
Ranjani
diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c
b/sound/soc/intel/boards/skl_hda_dsp_generic.c
index 11eaee9ae41f..dacf8014b870 100644
--- a/sound/soc/intel/boards/skl_hda_dsp_generic.c
+++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c
@@ -112,6 +112,7 @@ static char hda_soc_components[30];

 static int skl_hda_fill_card_info(struct snd_soc_acpi_mach_params
*mach_params)
 {
+       struct snd_soc_dai_link_component *platform;
        struct snd_soc_card *card = &hda_soc_card;
        struct snd_soc_dai_link *dai_link;
        u32 codec_count, codec_mask;
@@ -148,7 +149,8 @@ static int skl_hda_fill_card_info(struct
snd_soc_acpi_mach_params *mach_params)
        card->num_dapm_routes = num_route;

        for_each_card_prelinks(card, i, dai_link)
-               dai_link->platforms->name = mach_params->platform;
+               for_each_link_platforms(dai_link, i, platform)
+                       platform->name = mach_params->platform;

        return 0;
 }