[PATCH 1/2] ALSA: hda/conexant: Fix EAPD pin array overflow

[PATCH 1/2] ALSA: hda/conexant: Fix EAPD pin array overflow

[wangdich9700]

From: wangdicheng <wangdicheng@kylinos.cn>

The bounds check in cx_auto_parse_eapd() happens after the write,
so when a codec has more than 4 EAPD pins the 5th one gets written
to eapds[4] which is past the end of the array and clobbers the
adjacent dynamic_eapd field.

Swap the check and the write.

Signed-off-by: wangdicheng <wangdicheng@kylinos.cn>
---
 sound/hda/codecs/conexant.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
index 40da2832ba66..e7a2a073d22c 100644
--- a/sound/hda/codecs/conexant.c
+++ b/sound/hda/codecs/conexant.c
@@ -100,9 +100,9 @@ static void cx_auto_parse_eapd(struct hda_codec *codec)
 			continue;
 		if (!(snd_hda_query_pin_caps(codec, nid) & AC_PINCAP_EAPD))
 			continue;
-		spec->eapds[spec->num_eapds++] = nid;
 		if (spec->num_eapds >= ARRAY_SIZE(spec->eapds))
 			break;
+		spec->eapds[spec->num_eapds++] = nid;
 	}
 
 	/* NOTE: below is a wild guess; if we have more than two EAPDs,
-- 
2.25.1

[PATCH 2/2] ALSA: hda/conexant: Add NULL check for dc_mode_path

[wangdich9700]

From: wangdicheng <wangdicheng@kylinos.cn>

snd_hda_add_new_path() returns NULL when no path exists between the
given NIDs, but olpc_xo_update_mic_pins() passes dc_mode_path
straight to snd_hda_activate_path() which dereferences it without
checking. Add the missing NULL guards, same as the local path
variable already has in the same function.

Signed-off-by: wangdicheng <wangdicheng@kylinos.cn>
---
 sound/hda/codecs/conexant.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
index e7a2a073d22c..880fbbe5b643 100644
--- a/sound/hda/codecs/conexant.c
+++ b/sound/hda/codecs/conexant.c
@@ -451,7 +451,8 @@ static void olpc_xo_update_mic_pins(struct hda_codec *codec)
 	if (!spec->dc_enable) {
 		/* disable DC bias path and pin for port F */
 		update_mic_pin(codec, 0x1e, 0);
-		snd_hda_activate_path(codec, spec->dc_mode_path, false, false);
+		if (spec->dc_mode_path)
+			snd_hda_activate_path(codec, spec->dc_mode_path, false, false);
 
 		/* update port B (ext mic) and C (int mic) */
 		/* OLPC defers mic widget control until when capture is
@@ -487,7 +488,8 @@ static void olpc_xo_update_mic_pins(struct hda_codec *codec)
 		update_mic_pin(codec, 0x1b, 0);
 		/* enable DC bias path and pin */
 		update_mic_pin(codec, 0x1e, spec->recording ? PIN_IN : 0);
-		snd_hda_activate_path(codec, spec->dc_mode_path, true, false);
+		if (spec->dc_mode_path)
+			snd_hda_activate_path(codec, spec->dc_mode_path, true, false);
 	}
 }
 
-- 
2.25.1

Re: [PATCH 1/2] ALSA: hda/conexant: Fix EAPD pin array overflow

[Takashi Iwai]

On Wed, 29 Jul 2026 09:09:34 +0200,
wangdich9700@163.com wrote:
> 
> From: wangdicheng <wangdicheng@kylinos.cn>
> 
> The bounds check in cx_auto_parse_eapd() happens after the write,
> so when a codec has more than 4 EAPD pins the 5th one gets written
> to eapds[4] which is past the end of the array and clobbers the
> adjacent dynamic_eapd field.


No, it checks right after the increment, then aborts the loop.  So any
overwrite won't happen.


Takashi

> 
> Signed-off-by: wangdicheng <wangdicheng@kylinos.cn>
> ---
>  sound/hda/codecs/conexant.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
> index 40da2832ba66..e7a2a073d22c 100644
> --- a/sound/hda/codecs/conexant.c
> +++ b/sound/hda/codecs/conexant.c
> @@ -100,9 +100,9 @@ static void cx_auto_parse_eapd(struct hda_codec *codec)
>  			continue;
>  		if (!(snd_hda_query_pin_caps(codec, nid) & AC_PINCAP_EAPD))
>  			continue;
> -		spec->eapds[spec->num_eapds++] = nid;
>  		if (spec->num_eapds >= ARRAY_SIZE(spec->eapds))
>  			break;
> +		spec->eapds[spec->num_eapds++] = nid;
>  	}
>  
>  	/* NOTE: below is a wild guess; if we have more than two EAPDs,
> -- 
> 2.25.1
> 

Re: [PATCH 2/2] ALSA: hda/conexant: Add NULL check for dc_mode_path

[Takashi Iwai]

On Wed, 29 Jul 2026 09:09:35 +0200,
wangdich9700@163.com wrote:
> 
> From: wangdicheng <wangdicheng@kylinos.cn>
> 
> snd_hda_add_new_path() returns NULL when no path exists between the
> given NIDs, but olpc_xo_update_mic_pins() passes dc_mode_path
> straight to snd_hda_activate_path() which dereferences it without
> checking. Add the missing NULL guards, same as the local path
> variable already has in the same function.
> 
> Signed-off-by: wangdicheng <wangdicheng@kylinos.cn>

Applied to for-next branch now.  Thanks.


Takashi