Re: [RFC PATCH 5/8] ASoC: SDCA: class_function: xlate sound-dai cell by entity index

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing validation of `args->args_count` before accessing `args->args[0]` leads to reading uninitialized stack memory, causing arbitrary DAI matching or information leaks, and breaking the fallback for zero-cell sound-dai references.
--

--- Patch [5]: [RFC PATCH 5/8] ASoC: SDCA: class_function: xlate sound-dai cell by entity index ---
commit 1d17bfb5417d13a6da7e95f412ebc5f6ec81d329
Author: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>

ASoC: SDCA: class_function: xlate sound-dai cell by entity index
    
This commit registers a custom of_xlate_dai_name for SDCA functions. It maps 
a "sound-dai" phandle cell to a DAI by matching the cell value against the 
SDCA entity array index instead of relying on default positional mapping.

> diff --git a/sound/soc/sdca/sdca_class_function.c b/sound/soc/sdca/sdca_class_function.c
> index 905c96ed6172f..b0fbe243d732c 100644
> --- a/sound/soc/sdca/sdca_class_function.c
> +++ b/sound/soc/sdca/sdca_class_function.c
[ ... ]
> @@ -216,9 +216,44 @@ static int class_function_set_jack(struct snd_soc_component *component,
[ ... ]
> +static int class_function_of_xlate_dai_name(struct snd_soc_component *component,
> +					    const struct of_phandle_args *args,
> +					    const char **dai_name)
> +{
> +	struct class_function_drv *drv = snd_soc_component_get_drvdata(component);
> +	struct sdca_function_data *function = drv->function;
> +	int target = args->args[0];

[Severity: Medium]
Could this read uninitialized stack memory if args->args_count is 0?

When a devicetree defines #sound-dai-cells = <0> for the SDCA function node,
the core of_parse_phandle_with_args() successfully returns with args_count = 0.

Because the of_phandle_args structure is often allocated on the stack in 
callers like snd_soc_of_get_dlc(), the args->args array is left uninitialized.

Does this code need to verify args->args_count >= 1 before accessing
args->args[0] to prevent matching against random stack values?

If args_count is 0, should it return -ENOTSUPP to allow ALSA's default
0-cell handling to proceed instead of returning -EINVAL?

> +	int i;
> +
> +	for (i = 0; i < function->num_entities - 1; i++) {
[ ... ]
> +		if (i == target) {
> +			*dai_name = entity->label;
> +			return 0;
> +		}
> +	}
> +
> +	dev_err(component->dev, "xlate: no dataport entity at index %d (num_entities=%d)\n",
> +		target, function->num_entities);

[Severity: Medium]
If target is populated from an uninitialized args->args[0] due to a 0-cell
reference, does printing it here leak kernel stack memory to the log?

> +	return -EINVAL;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722234221.884765-1-srinivas.kandagatla@oss.qualcomm.com?part=5