diff mbox series

ASoC: audio-graph-card2: fix off by one in graph_parse_node_multi_nm()

Message ID 1032216f-902f-48f9-aa49-9d5ece8e87f2@moroto.mountain
State New
Headers
Series ASoC: audio-graph-card2: fix off by one in graph_parse_node_multi_nm() |

Commit Message

Dan Carpenter Dec. 4, 2023, 12:42 p.m. UTC 
  The > comparison should be >= to avoid writing one element beyond the end
of the dai_link->ch_maps[] array.  The dai_link->ch_maps[] array is
allocated in graph_parse_node_multi() and it has "nm_max" elements.

Fixes: e2de6808df4a ("ASoC: audio-graph-card2: add CPU:Codec = N:M support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
In this same function I was also concerned about these conditions:

if (cpu_idx > dai_link->num_cpus)
if (codec_idx > dai_link->num_codecs)

But I wasn't able to see out how those idx variables are actually
used.

 sound/soc/generic/audio-graph-card2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Kuninori Morimoto Dec. 7, 2023, 1 a.m. UTC | #1 
Hi Dan

> The > comparison should be >= to avoid writing one element beyond the end
> of the dai_link->ch_maps[] array.  The dai_link->ch_maps[] array is
> allocated in graph_parse_node_multi() and it has "nm_max" elements.
> 
> Fixes: e2de6808df4a ("ASoC: audio-graph-card2: add CPU:Codec = N:M support")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---

Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>

> In this same function I was also concerned about these conditions:
> 
> if (cpu_idx > dai_link->num_cpus)
> if (codec_idx > dai_link->num_codecs)
> 
> But I wasn't able to see out how those idx variables are actually
> used.

These also ">=" I think.

Thank you for pointing it

Best regards
---
Renesas Electronics
Ph.D. Kuninori Morimoto
Mark Brown Dec. 7, 2023, 6:25 p.m. UTC | #2 
On Mon, 04 Dec 2023 15:42:07 +0300, Dan Carpenter wrote:
> The > comparison should be >= to avoid writing one element beyond the end
> of the dai_link->ch_maps[] array.  The dai_link->ch_maps[] array is
> allocated in graph_parse_node_multi() and it has "nm_max" elements.
> 
> 

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next

Thanks!

[1/1] ASoC: audio-graph-card2: fix off by one in graph_parse_node_multi_nm()
      commit: d685aea5e0a89b66679e5266320ab2ba4378c754

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark
diff mbox series

Patch

diff --git a/sound/soc/generic/audio-graph-card2.c b/sound/soc/generic/audio-graph-card2.c
index d9e10308a508..78d9679decda 100644
--- a/sound/soc/generic/audio-graph-card2.c
+++ b/sound/soc/generic/audio-graph-card2.c
@@ -557,7 +557,7 @@  static int graph_parse_node_multi_nm(struct snd_soc_dai_link *dai_link,
 		struct device_node *mcodec_port;
 		int codec_idx;
 
-		if (*nm_idx > nm_max)
+		if (*nm_idx >= nm_max)
 			break;
 
 		mcpu_ep_n = of_get_next_child(mcpu_port, mcpu_ep_n);