Re: [linux-next:master 6294/10910] sound/soc/sof/amd/acp.c:1469 handle_amd_sof_acp7x_sdw_pme_event() error: buffer overflow 'adata->sdw->pdev' 2 <= 3

["Mukunda,Vijendar" <vijendar.mukunda@amd.com>]

On 9/27/26 20:52, Dan Carpenter wrote:
> [You don't often get email from error27@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> head:   f5f84daefcd92d7a630066635ecea1433ed5eac7
> commit: be2823854e00558f46f5bbb124bb3f3a3bb9a94a [6294/10910] ASoC: SOF: amd: add SoundWire PM ops for ACP7.B/7.F
> config: i386-randconfig-2200-20260927 (https://download.01.org/0day-ci/archive/20260927/202609271355.u0pymQoF-lkp@intel.com/config)
> compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)
> smatch: v0.5.0-9187-g5189e3fb
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Reported-by: Dan Carpenter <error27@gmail.com>
> | Closes: https://lore.kernel.org/r/202609271355.u0pymQoF-lkp@intel.com/
>
> New smatch warnings:
> sound/soc/sof/amd/acp.c:1469 handle_amd_sof_acp7x_sdw_pme_event() error: buffer overflow 'adata->sdw->pdev' 2 <= 3
++

Thank you for the report. This smatch warning is reported because the 
ACP7.B/7.F SoundWire specific patches have not yet landed. Those patches 
add support for 4 SoundWire manager instances and allocate the platform 
device array based on the maximum instance count, which resolves the 
buffer overflow concern flagged here. We are currently waiting for the 
dependent patch series to complete upstream review: 
https://lkml.org/lkml/2026/9/17/1422 
https://lkml.org/lkml/2026/9/17/2552 If the review of the above series 
takes longer, we will post the ACP7.B/7.F SoundWire patches for upstream 
review independently and include a note in the cover letter documenting 
the patch series dependency.
>
> Old smatch warnings:
> sound/soc/sof/amd/acp.c:663 sof_amd_handle_acp7x_sdw_wake_event() error: buffer overflow 'adata->sdw->pdev' 2 <= 3
> sound/soc/sof/amd/acp.c:666 sof_amd_handle_acp7x_sdw_wake_event() error: buffer overflow 'adata->sdw->pdev' 2 <= 3
> sound/soc/sof/amd/acp.c:1472 handle_amd_sof_acp7x_sdw_pme_event() error: buffer overflow 'adata->sdw->pdev' 2 <= 3
>
> vim +1469 sound/soc/sof/amd/acp.c
>
> be2823854e0055 Vijendar Mukunda 2026-09-10  1440  static void handle_amd_sof_acp7x_sdw_pme_event(struct snd_sof_dev *sdev)
> be2823854e0055 Vijendar Mukunda 2026-09-10  1441  {
> be2823854e0055 Vijendar Mukunda 2026-09-10  1442        struct acp_dev_data *adata;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1443        struct amd_sdw_manager *amd_manager;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1444        u32 sdw_pme_stat;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1445        u32 sdw_wake_en;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1446        u32 pme_reg;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1447        u32 wake_mask;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1448        unsigned int instance;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1449
> be2823854e0055 Vijendar Mukunda 2026-09-10  1450        adata = sdev->pdata->hw_pdata;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1451        if (!adata->sdw)
> be2823854e0055 Vijendar Mukunda 2026-09-10  1452                return;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1453
> be2823854e0055 Vijendar Mukunda 2026-09-10  1454        for (instance = 0; instance < ACP7X_SDW_MAX_MANAGER_COUNT; instance++) {
> be2823854e0055 Vijendar Mukunda 2026-09-10  1455                pme_reg = ACP7X_SW_PME_STS + (instance * 4);
> be2823854e0055 Vijendar Mukunda 2026-09-10  1456                wake_mask = ACP7X_SW_WAKE_EN_MASK << instance;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1457
> be2823854e0055 Vijendar Mukunda 2026-09-10  1458                sdw_pme_stat = snd_sof_dsp_read(sdev, ACP_DSP_BAR, pme_reg);
> be2823854e0055 Vijendar Mukunda 2026-09-10  1459                if (!sdw_pme_stat)
> be2823854e0055 Vijendar Mukunda 2026-09-10  1460                        continue;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1461
> be2823854e0055 Vijendar Mukunda 2026-09-10  1462                mutex_lock(&adata->acp_lock);
> be2823854e0055 Vijendar Mukunda 2026-09-10  1463                sdw_wake_en = snd_sof_dsp_read(sdev, ACP_DSP_BAR, ACP7X_SW_WAKE_EN);
> be2823854e0055 Vijendar Mukunda 2026-09-10  1464                sdw_wake_en &= ~wake_mask;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1465                snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP7X_SW_WAKE_EN, sdw_wake_en);
> be2823854e0055 Vijendar Mukunda 2026-09-10  1466                mutex_unlock(&adata->acp_lock);
> be2823854e0055 Vijendar Mukunda 2026-09-10  1467                snd_sof_dsp_write(sdev, ACP_DSP_BAR, pme_reg, sdw_pme_stat);
> be2823854e0055 Vijendar Mukunda 2026-09-10  1468
> be2823854e0055 Vijendar Mukunda 2026-09-10 @1469                if (!adata->sdw->pdev[instance])
>                                                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^
> Feels like a bug.  AMD_SDW_MAX_MANAGER_COUNT(2) vs ACP7X_SDW_MAX_MANAGER_COUNT(4)
>
> be2823854e0055 Vijendar Mukunda 2026-09-10  1470                        continue;
> be2823854e0055 Vijendar Mukunda 2026-09-10  1471
> be2823854e0055 Vijendar Mukunda 2026-09-10  1472                amd_manager = dev_get_drvdata(&adata->sdw->pdev[instance]->dev);
> be2823854e0055 Vijendar Mukunda 2026-09-10  1473                if (amd_manager)
> be2823854e0055 Vijendar Mukunda 2026-09-10  1474                        pm_request_resume(amd_manager->dev);
> be2823854e0055 Vijendar Mukunda 2026-09-10  1475        }
> be2823854e0055 Vijendar Mukunda 2026-09-10  1476  }
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki