[PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

[PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

[Harshit Mogalapalli]

ida_alloc_max() interprets its max argument as inclusive.

Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
allocated, but the IRQ domain created for the bus is sized for IDs
0-15.  If 16 is returned, irq_create_mapping() fails and the driver
ends up with an invalid IRQ mapping.

Limit the allocation to 0-15 by passing SDW_FW_MAX_DEVICES - 1.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202512240450.hlDH3nCs-lkp@intel.com/
Fixes: aab12022b076 ("soundwire: bus: Add internal slave ID and use for IRQs")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
---
Only compile tested.
---
 drivers/soundwire/bus_type.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soundwire/bus_type.c b/drivers/soundwire/bus_type.c
index 80ed3468e860..a05aa36828cb 100644
--- a/drivers/soundwire/bus_type.c
+++ b/drivers/soundwire/bus_type.c
@@ -99,7 +99,7 @@ static int sdw_bus_probe(struct device *dev)
 	if (ret)
 		return ret;
 
-	ret = ida_alloc_max(&slave->bus->slave_ida, SDW_FW_MAX_DEVICES, GFP_KERNEL);
+	ret = ida_alloc_max(&slave->bus->slave_ida, SDW_FW_MAX_DEVICES - 1, GFP_KERNEL);
 	if (ret < 0) {
 		dev_err(dev, "Failed to allocated ID: %d\n", ret);
 		return ret;
-- 
2.47.3

Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

[Markus Elfring]

…
> Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> allocated, but the IRQ domain created for the bus is sized for IDs
> 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> ends up with an invalid IRQ mapping.
…

See also once more:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc4#n659

Regards,
Markus

Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

[Dan Carpenter]

On Sun, Jan 11, 2026 at 10:27:08AM +0100, Markus Elfring wrote:
> …
> > Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> > allocated, but the IRQ domain created for the bus is sized for IDs
> > 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> > ends up with an invalid IRQ mapping.
> …
> 
> See also once more:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc4#n659
> 

Markus, please only comment when it's a bug in the patch instead of
wrong advice about commit messages.

regards,
dan carpenter

Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

[Dan Carpenter]

On Mon, Jan 12, 2026 at 11:26:51AM +0300, Dan Carpenter wrote:
> On Sun, Jan 11, 2026 at 10:27:08AM +0100, Markus Elfring wrote:
> > …
> > > Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> > > allocated, but the IRQ domain created for the bus is sized for IDs
> > > 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> > > ends up with an invalid IRQ mapping.
> > …
> > 
> > See also once more:
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc4#n659
> > 
> 
> Markus, please only comment when it's a bug in the patch instead of
> wrong advice about commit messages.

Sorry, if that was unclear.  The link is a real link to the documentation
which says:

  - The body of the explanation, line wrapped at 75 columns, which will
    be copied to the permanent changelog to describe this patch.

The rules that we write down are simplified guidelines which are designed
to be easy explain.  75 is the upper bound where checkpatch will complain.
But I think line wrapping at 72 or 74 characters is more common.  Either
way it's fine.

regards,
dan carpenter

Re: soundwire: bus: fix off-by-one when allocating slave IDs

[Markus Elfring]

> Sorry, if that was unclear.  The link is a real link to the documentation
> which says:
> 
>   - The body of the explanation, line wrapped at 75 columns, which will
>     be copied to the permanent changelog to describe this patch.
> 
> The rules that we write down are simplified guidelines which are designed
> to be easy explain.  75 is the upper bound where checkpatch will complain.
…

Can we benefit a bit more from this system configuration setting
instead of performing word wrapping at around the column 67 here?

Regards,
Markus

Re: soundwire: bus: fix off-by-one when allocating slave IDs

[Richard Fitzgerald]

On 12/01/2026 10:55 am, Markus Elfring wrote:
>> Sorry, if that was unclear.  The link is a real link to the documentation
>> which says:
>>
>>    - The body of the explanation, line wrapped at 75 columns, which will
>>      be copied to the permanent changelog to describe this patch.
>>
>> The rules that we write down are simplified guidelines which are designed
>> to be easy explain.  75 is the upper bound where checkpatch will complain.
> …
> 
> Can we benefit a bit more from this system configuration setting
Why is this wrapped at column 64?

> instead of performing word wrapping at around the column 67 here?
> 
> Regards,
> Markus
> 

Re: soundwire: bus: fix off-by-one when allocating slave IDs

[Vinod Koul]

On 12-01-26, 11:13, Richard Fitzgerald wrote:
> On 12/01/2026 10:55 am, Markus Elfring wrote:
> > > Sorry, if that was unclear.  The link is a real link to the documentation
> > > which says:
> > > 
> > >    - The body of the explanation, line wrapped at 75 columns, which will
> > >      be copied to the permanent changelog to describe this patch.
> > > 
> > > The rules that we write down are simplified guidelines which are designed
> > > to be easy explain.  75 is the upper bound where checkpatch will complain.
> > …
> > 
> > Can we benefit a bit more from this system configuration setting
> Why is this wrapped at column 64?

Good one :-)

I have a tendency to not look into a lot of things our friend is asking
for, seems to be not worth your time!

-- 
~Vinod

Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

[Charles Keepax]

On Sat, Jan 10, 2026 at 12:19:58PM -0800, Harshit Mogalapalli wrote:
> ida_alloc_max() interprets its max argument as inclusive.
> 
> Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> allocated, but the IRQ domain created for the bus is sized for IDs
> 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> ends up with an invalid IRQ mapping.
> 
> Limit the allocation to 0-15 by passing SDW_FW_MAX_DEVICES - 1.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/r/202512240450.hlDH3nCs-lkp@intel.com/
> Fixes: aab12022b076 ("soundwire: bus: Add internal slave ID and use for IRQs")
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
> ---

Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>

Thanks,
Charles

Re: [PATCH] soundwire: bus: fix off-by-one when allocating slave IDs

[Vinod Koul]

On Sat, 10 Jan 2026 12:19:58 -0800, Harshit Mogalapalli wrote:
> ida_alloc_max() interprets its max argument as inclusive.
> 
> Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be
> allocated, but the IRQ domain created for the bus is sized for IDs
> 0-15.  If 16 is returned, irq_create_mapping() fails and the driver
> ends up with an invalid IRQ mapping.
> 
> [...]

Applied, thanks!

[1/1] soundwire: bus: fix off-by-one when allocating slave IDs
      commit: 12d4fd9a657174496677cff2841315090f1c11fc

Best regards,
-- 
~Vinod