Re: [PATCH] ALSA: hda/hdmi: clamp num_cvts against cvt_nids[] in hdmi_read_pin_conn

[Takashi Iwai <tiwai@suse.de>]

On Thu, 08 Oct 2026 10:51:22 +0200,
Peter Ujfalusi wrote:
> 
> hdmi_add_cvt() stores each converter's NID into the fixed-size
> spec->cvt_nids[] array (used only by the Intel Haswell pin-connection
> fixup), but only when spec->num_cvts is still within
> ARRAY_SIZE(cvt_nids); the num_cvts counter itself is incremented
> unconditionally regardless of whether the store happened. A codec
> that reports more converters than cvt_nids[] can hold therefore ends
> up with num_cvts > ARRAY_SIZE(cvt_nids).
> 
> hdmi_read_pin_conn(), on the intel_hsw_fixup path, copies num_cvts
> elements from cvt_nids[] with memcpy(), so once num_cvts exceeds the
> array size this reads past cvt_nids[] and writes the resulting
> garbage NIDs into per_pin->mux_nids[].
> 
> Clamp the copy length to the actual size of cvt_nids[] instead of
> trusting num_cvts, which is also used unbounded as the size of the
> separate, dynamically-sized spec->cvts array and must not be
> truncated at the source.
> 
> Fixes: bce0d2a80e42 ("ALSA: hda - Allow unlimited pins and converters in patch_hdmi.c")
> Cc: stable@vger.kernel.org
> Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>

Applied to for-next branch.  Thanks.


Takashi