Re: [PATCH v7 08/10] ASoC: qcom: Add QAIF IRQ handling and platform register

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Uninitialized memory access when reading IOMMU Stream ID
--

commit 033356d64f07f9a066675a08dfb513468fd441a1
Author: Harendra Gautam <harendra.gautam@oss.qualcomm.com>

ASoC: qcom: Add QAIF IRQ handling and platform register

This commit finishes the QAIF PCM platform support so streams can be
registered, started, stopped, and serviced by DMA interrupts. It registers
the ASoC component, requests the QAIF interrupt, and adds trigger handling
to enable or disable DMA and its interrupt sources.

> diff --git a/sound/soc/qcom/qaif-platform.c b/sound/soc/qcom/qaif-platform.c
> --- a/sound/soc/qcom/qaif-platform.c
> +++ b/sound/soc/qcom/qaif-platform.c

[ ... ]

> +int asoc_qcom_qaif_platform_register(struct platform_device *pdev)
> +{
> +	struct qaif_drv_data *drvdata = platform_get_drvdata(pdev);
> +	struct of_phandle_args iommu_spec;
> +	u32 sid;
> +	int ret;
> +
> +	if (!drvdata->variant->alloc_stream_dma_idx ||
> +	    !drvdata->variant->free_stream_dma_idx)
> +		return dev_err_probe(&pdev->dev, -EINVAL,
> +				     "Variant missing mandatory callbacks\n");
> +
> +	ret = of_parse_phandle_with_args(pdev->dev.of_node,
> +					 "iommus", "#iommu-cells", 0,
> +					 &iommu_spec);
> +	if (ret)
> +		return dev_err_probe(&pdev->dev, ret,
> +				     "failed to parse iommus property\n");
> +	sid = iommu_spec.args[0];

[Severity: Medium]
Could this read uninitialized stack memory if the device tree specifies an
IOMMU node with a zero argument count?

If of_parse_phandle_with_args() succeeds but finds zero arguments, it will
set iommu_spec.args_count to 0 without writing to the iommu_spec.args array.
Reading iommu_spec.args[0] unconditionally would then configure the hardware
with a garbage stream ID from the uninitialized stack, potentially causing
IOMMU context faults and breaking audio DMA.

Does this code need to validate that iommu_spec.args_count is greater than 0
before accessing the arguments array?

> +	of_node_put(iommu_spec.np);
> +	drvdata->smmu_csid_bits = sid & QAIF_CSID_MASK;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923-b4-qaif-shikra-audio-v7-0-d5b6f056568e@oss.qualcomm.com?part=8