Re: [PATCH] ALSA: x86: hdmi: fix chmap array missing terminator entry

[Takashi Iwai <tiwai@suse.de>]

On Thu, 08 Oct 2026 10:54:11 +0200,
Peter Ujfalusi wrote:
> 
> had_build_channel_allocation_map() allocates a single struct
> snd_pcm_chmap_elem via kzalloc() and stores it as
> intelhaddata->chmap->chmap. struct snd_pcm_chmap.chmap is expected to
> be a zero-terminated array (see snd_pcm_std_chmaps[]), but
> had_register_chmap_ctls() never overrides the TLV callback installed
> by snd_pcm_add_chmap_ctls(), so the generic pcm_chmap_ctl_tlv() from
> ALSA core is left in place.
> 
> pcm_chmap_ctl_tlv() is reachable by any local user via
> SNDRV_CTL_IOCTL_TLV_READ on the "Playback Channel Map" control and
> walks the array with "for (map = info->chmap; map->channels; map++)".
> Since the driver's single element is never terminated, this walks
> past the allocation. The same pointer is also freed on hot-unplug and
> rebuilt on hot-plug under intelhaddata->mutex, while the TLV callback
> runs under card->controls_rwsem without that mutex, so the walk can
> also race a concurrent free of the array.
> 
> Fix this by allocating a second, zeroed element so the array is
> properly terminated, and by dropping the inherited TLV callback
> entirely at registration time, since the driver never implements one
> of its own.
> 
> Fixes: 5dab11d89777 ("ALSA: x86: hdmi: Add audio support for BYT and CHT")
> Cc: stable@vger.kernel.org
> Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>

Applied to for-next branch.  Thanks.


Takashi