From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792593175; b=mtCLeiNwkpok3dRsTL6V/qNc9KdFlCrt9RPXkStrKpF70DQxWKAg32dx+zwloDSEVSm5 bwjjBjTfhZEf3s9rQ8/tvRiPNpp/+o+wXc9W3WSQuR6fNuATo8VNrJlgXtG+FyXhFXMPr RrJtYLe47g2nx1QJkT8fiEv1rNSAP/nFEGRlf+1/NPz2ntZOwOudZQdGBMom4n5lxWasm lL/GIBlpUOUqb6+H43wPLUgQZusYLnosaXknI4dNTR9D5v0YIB0KlQDEdI90Bka8LGjiu GYKZKA2Xc4dL5g79Ezvax2JhmQe+LeSvT4BUMGplt1HPZHmydCzKukVLhpnvUd3HJrg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792593175; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=DLvDwdNaNC8KYUMlhxryrvaZbX9GOSYKKrFfEzsmw6c=; b=O+bOeN6b0YdJNxUOM1uw6q3T/IYmZ4Ry4piUOP/XCc81kuheqfZK0z0HV5FQ2wW634Xr YzDLC/rGO+TG7ss+v2ragi5JwmE5/ma2fv31H5dpCaf5kHTB/Nui+qvviCkWiHsKnKy1Y gl9jnXxmTWVsWyPcr4xVSJdsQsNmDPaM9Rajk/dxgFFY5Y67MNC04P4tJXDdjZ4MY32Hl M2nagEr4OXJRweMGajQpQswP1hQB/FtLsOH2fQpMsuPPpRoF+HcwkiIsSvPOhmHevkp8Z 5FzPOxyLQquzRqjBY0XAUoKtor0xlBT+Ztq6ULElHoIhIs/icN46ZUvP7/0veErzhGA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=nOMCW7p6; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9FA4606A31B for ; Wed, 21 Oct 2026 14:32:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=nOMCW7p6 Received: by smtp.kernel.org (Postfix) with ESMTPSA id D63131F000C4; Wed, 21 Oct 2026 14:32:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792593174; bh=DLvDwdNaNC8KYUMlhxryrvaZbX9GOSYKKrFfEzsmw6c=; h=Subject:To:Cc:From:Date; b=nOMCW7p6eOzdbjmMKo2HK5KsWBH7rK1Hpy7tfzuc8KP1t9yXbniA4vsUuPxwCLB6l Vtbv3hqWvSMMFrbwq4dXYknKU2STsXM1DxUZPiQMwdZQtP6EG9dPPm7vMNeqnvrb9z NYnohi0WfisdZiNdtY+MRB+Cdlc0zViLDvlPpw8E= Subject: FAILED: patch "[PATCH] ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for" failed to apply to 6.18-stable tree To: peter.ujfalusi@linux.intel.com,broonie@kernel.org,yung-chuan.liao@linux.intel.com Cc: From: Date: Wed, 21 Oct 2026 16:32:25 +0200 Message-ID: <2026102124-wisdom-print-3a6c@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 746de48c3a250f0c264105dcbfcdf0c5001e970b # git commit -s git send-email --to '' --in-reply-to '2026102124-wisdom-print-3a6c@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 746de48c3a250f0c264105dcbfcdf0c5001e970b Mon Sep 17 00:00:00 2001 From: Peter Ujfalusi Date: Thu, 8 Oct 2026 12:01:30 +0300 Subject: [PATCH] ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_cfg.device_count truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent: UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int' Treat ch_count < device_count the same way as the existing "channels equal to output reference channels" case: apply the same ch_mask to every aggregated device instead of trying to split channels that can't be evenly divided. Fixes: 0390a102cc18 ("ASoC: SOF: ipc4-topology: use different channel mask for each sdw amp feedback") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Link: https://patch.msgid.link/20261008090130.15135-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c index 24a1175dd690..22c15fbb93f2 100644 --- a/sound/soc/sof/ipc4-topology.c +++ b/sound/soc/sof/ipc4-topology.c @@ -2458,11 +2458,14 @@ _sof_ipc4_prepare_copier_module(struct snd_sof_widget *swidget, ch_map >>= 4; } - if (swidget->id == snd_soc_dapm_dai_in && ch_count == out_ref_channels) { + if ((swidget->id == snd_soc_dapm_dai_in && ch_count == out_ref_channels) || + ch_count < blob->alh_cfg.device_count) { /* * For playback DAI widgets where the channel number is equal to - * the output reference channels, set the step = 0 to ensure all - * the ch_mask is applied to all alh mappings. + * the output reference channels, or when there are fewer + * channels than aggregated devices (e.g. a mono capture + * stream split across multiple links), set step = 0 to + * ensure all the ch_mask is applied to all alh mappings. */ mask = ch_mask; step = 0;