Re: [PATCH v9 09/10] ASoC: qcom: Add Shikra QAIF support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] asoc: qcom: qaif: uninitialized stack read on zero iommu-cells
--

commit 205b884308f0fc7a573192d7a53b7c016d2a1163
Author: Harendra Gautam <harendra.gautam@oss.qualcomm.com>

ASoC: qcom: Add Shikra QAIF support

Add the Shikra variant data for the Qualcomm Audio Interface driver so
the common QAIF code can bind to the Shikra QAIF device and expose the
SoC-specific DAIs.

> diff --git a/sound/soc/qcom/qaif-shikra.c b/sound/soc/qcom/qaif-shikra.c
> new file mode 100644
> index 0000000000000..2db3995a2de04
> --- /dev/null
> +++ b/sound/soc/qcom/qaif-shikra.c
[ ... ]
> +static const struct of_device_id shikra_qaif_cpu_device_id[] = {
> +	{ .compatible = "qcom,shikra-qaif-cpu", .data = &shikra_qaif_data },
> +	{}
> +};
> +MODULE_DEVICE_TABLE(of, shikra_qaif_cpu_device_id);
> +
> +static struct platform_driver shikra_qaif_cpu_platform_driver = {
> +	.driver = {
> +		.name = "shikra-qaif-cpu",
> +		.of_match_table = shikra_qaif_cpu_device_id,
> +		.pm = pm_ptr(&asoc_qcom_qaif_pm_ops),
> +	},
> +	.probe = asoc_qcom_qaif_cpu_platform_probe,

[Severity: Medium]
When probing this new device, could this lead to an uninitialized kernel stack
memory read?

If a device tree is provided where the target iommus node has
"#iommu-cells = <0>", of_parse_phandle_with_args() returns successfully
with args_count = 0 without zeroing out the args array.

In sound/soc/qcom/qaif-platform.c:asoc_qcom_qaif_platform_register(),
which is reachable from this probe path:

	ret = of_parse_phandle_with_args(pdev->dev.of_node,
					 "iommus", "#iommu-cells", 0,
					 &iommu_spec);
	if (ret)
		return dev_err_probe(&pdev->dev, ret,
				     "failed to parse iommus property\n");
	sid = iommu_spec.args[0];

Because the iommu_spec structure is allocated on the stack, reading
iommu_spec.args[0] here fetches uninitialized kernel stack data without
checking if args_count > 0. This stack data is then masked with
QAIF_CSID_MASK and programmed into a hardware register, causing a minor
information leak and potential IOMMU configuration failure.

> +};
> +module_platform_driver(shikra_qaif_cpu_platform_driver);
> +
> +MODULE_DESCRIPTION("Qualcomm Audio Interface (QAIF) Shikra variant driver");
> +MODULE_AUTHOR("Harendra Gautam <harendra.gautam@oss.qualcomm.com>");
> +MODULE_LICENSE("GPL");

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013-b4-qaif-shikra-audio-v9-0-f3022e28f2fd@oss.qualcomm.com?part=9