[PATCH] ALSA: core: Validate compress device numbers without dynamic minors

[PATCH] ALSA: core: Validate compress device numbers without dynamic minors

[Cássio Gabriel]

Without CONFIG_SND_DYNAMIC_MINORS, ALSA reserves only two fixed minors
for compress devices on each card: comprD0 and comprD1.

snd_find_free_minor() currently computes the compress minor as
type + dev without validating dev first, so device numbers greater than
1 spill into the HWDEP minor range instead of failing registration.

ASoC passes rtd->id to snd_compress_new(), so this can happen on real
non-dynamic-minor builds.

Add a dedicated fixed-minor check for SNDRV_DEVICE_TYPE_COMPRESS in
snd_find_free_minor() and reject out-of-range device numbers with
-EINVAL before constructing the minor.

Also remove the stale TODO in compress_offload.c that still claims
multiple compress nodes are missing.

Fixes: 3eafc959b32f ("ALSA: core: add support for compressed devices")
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
---
 sound/core/compress_offload.c | 7 -------
 sound/core/sound.c            | 7 +++++++
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index fdba6e4b25fd..5a0308eb4e31 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -41,13 +41,6 @@
 #define COMPR_CODEC_CAPS_OVERFLOW
 #endif
 
-/* TODO:
- * - add substream support for multiple devices in case of
- *	SND_DYNAMIC_MINORS is not used
- * - Multiple node representation
- *	driver should be able to register multiple nodes
- */
-
 struct snd_compr_file {
 	unsigned long caps;
 	struct snd_compr_stream stream;
diff --git a/sound/core/sound.c b/sound/core/sound.c
index 93436db24710..8d05fe0d263b 100644
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -216,9 +216,16 @@ static int snd_find_free_minor(int type, struct snd_card *card, int dev)
 	case SNDRV_DEVICE_TYPE_RAWMIDI:
 	case SNDRV_DEVICE_TYPE_PCM_PLAYBACK:
 	case SNDRV_DEVICE_TYPE_PCM_CAPTURE:
+		if (snd_BUG_ON(!card))
+			return -EINVAL;
+		minor = SNDRV_MINOR(card->number, type + dev);
+		break;
 	case SNDRV_DEVICE_TYPE_COMPRESS:
 		if (snd_BUG_ON(!card))
 			return -EINVAL;
+		if (dev < 0 ||
+		    dev >= SNDRV_MINOR_HWDEP - SNDRV_MINOR_COMPRESS)
+			return -EINVAL;
 		minor = SNDRV_MINOR(card->number, type + dev);
 		break;
 	default:

---
base-commit: b3c48fa1fb397b490101785ddd87caf2e5513a66
change-id: 20260325-alsa-compress-static-minors-1bedfc90a7bf

Best regards,
--  
Cássio Gabriel <cassiogabrielcontato@gmail.com>

Re: [PATCH] ALSA: core: Validate compress device numbers without dynamic minors

[Takashi Iwai]

On Wed, 25 Mar 2026 06:24:04 +0100,
Cássio Gabriel wrote:
> 
> Without CONFIG_SND_DYNAMIC_MINORS, ALSA reserves only two fixed minors
> for compress devices on each card: comprD0 and comprD1.
> 
> snd_find_free_minor() currently computes the compress minor as
> type + dev without validating dev first, so device numbers greater than
> 1 spill into the HWDEP minor range instead of failing registration.
> 
> ASoC passes rtd->id to snd_compress_new(), so this can happen on real
> non-dynamic-minor builds.
> 
> Add a dedicated fixed-minor check for SNDRV_DEVICE_TYPE_COMPRESS in
> snd_find_free_minor() and reject out-of-range device numbers with
> -EINVAL before constructing the minor.
> 
> Also remove the stale TODO in compress_offload.c that still claims
> multiple compress nodes are missing.
> 
> Fixes: 3eafc959b32f ("ALSA: core: add support for compressed devices")
> Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>

Applied to for-next branch now.  Thanks.


Takashi