Re: [PATCH v4 1/4] ASoC: dt-bindings: qcom: add LPASS LPR vote clock ID

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly added clock ID `LPASS_HW_LPR_VOTE` (104) exceeds the driver's hardcoded `Q6DSP_MAX_CLK_ID` limit, rendering it unusable and creating an out-of-bounds array write hazard.
--

--- Patch [1]: [PATCH v4 1/4] ASoC: dt-bindings: qcom: add LPASS LPR vote clock ID ---
commit de8b22fd20a65bf92d9b09b0009733d46893c763
Author: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com>

ASoC: dt-bindings: qcom: add LPASS LPR vote clock ID

Add a new clock ID, LPASS_HW_LPR_VOTE, to represent the LPASS low-power
resource (LPR) vote through the PRM interface. Exposing this as a q6prm
clock ID allows clients to request the LPR vote using the existing
qcom,q6prm clock provider interface. Drop Q6AFE_MAX_CLK_ID from the
bindings since it is not used in-tree.

> diff --git a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
> index 45850f2d43425..ce5e8589dd1a7 100644
> --- a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
> +++ b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
> @@ -236,8 +236,8 @@
>  #define LPASS_HW_AVTIMER_VOTE		101
>  #define LPASS_HW_MACRO_VOTE		102
>  #define LPASS_HW_DCODEC_VOTE		103
> +#define LPASS_HW_LPR_VOTE		104

[Severity: High]
With LPASS_HW_LPR_VOTE being set to 104, does this exceed the driver's maximum
clock limit?

Looking at sound/soc/qcom/qdsp6/q6dsp-lpass-clocks.c, Q6DSP_MAX_CLK_ID is
set to 104:

sound/soc/qcom/qdsp6/q6dsp-lpass-clocks.c:
#define Q6DSP_MAX_CLK_ID			104

This causes q6dsp_of_clk_hw_get() to reject the new clock ID:

sound/soc/qcom/qdsp6/q6dsp-lpass-clocks.c:q6dsp_of_clk_hw_get() {
    ...
	if (idx >= Q6DSP_MAX_CLK_ID || attr > LPASS_CLK_ATTRIBUTE_COUPLE_DIVISOR) {
		dev_err(cc->dev, "Invalid clk specifier (%d, %d)\n", idx, attr);
		return ERR_PTR(-EINVAL);
	}
    ...
}

Will this also cause an out of bounds write during probe if the ID is used?

The clock array is sized with Q6DSP_MAX_CLK_ID:

sound/soc/qcom/qdsp6/q6dsp-lpass-clocks.c:
struct q6dsp_cc {
	struct device *dev;
	struct q6dsp_clk *clks[Q6DSP_MAX_CLK_ID];
	const struct q6dsp_clk_desc *desc;
};

If ID 104 is added to the driver's clock array in the future,
q6dsp_clock_dev_probe() will write past the end of the clks array,
overwriting the adjacent desc pointer.

>  
> -#define Q6AFE_MAX_CLK_ID			104
>  
>  #define LPASS_CLK_ATTRIBUTE_INVALID		0x0
>  #define LPASS_CLK_ATTRIBUTE_COUPLE_NO		0x1

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720130511.493295-1-prasad.kumpatla@oss.qualcomm.com?part=1