[PATCH] ASoC: q6apm: fix array out of bounds on lpass ports

[PATCH] ASoC: q6apm: fix array out of bounds on lpass ports

[Srinivas Kandagatla]

lpass ports numbers have been added but the apm driver never got updated
with new max port value that it uses to store dai specific data.

This will result in array out of bounds and weird driver behaviour.
Fix this by adding a new LPASS_MAX_PORT which is can be used by driver
instead of using number and any new port additional can only be done in
one place, which should avoid these type of mistakes in future.

Also update the driver to use this LPASS_MAX_PORT.

Fixes: 55b5fb369c02 ("ASoC: dt-bindings: qcom,q6dsp-lpass-ports: Add USB_RX port")
Cc: Stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
---
 include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h | 1 +
 sound/soc/qcom/lpass.h                             | 2 +-
 sound/soc/qcom/qdsp6/q6apm.h                       | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
index 6d1ce7f5da51..b4856627ad00 100644
--- a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
+++ b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
@@ -140,6 +140,7 @@
 #define DISPLAY_PORT_RX_6	134
 #define DISPLAY_PORT_RX_7	135
 #define USB_RX			136
+#define LPASS_MAX_PORT		USB_RX
 
 #define LPASS_CLK_ID_PRI_MI2S_IBIT	1
 #define LPASS_CLK_ID_PRI_MI2S_EBIT	2
diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h
index de3ec6f594c1..99b0b6651fad 100644
--- a/sound/soc/qcom/lpass.h
+++ b/sound/soc/qcom/lpass.h
@@ -17,7 +17,7 @@
 #include "lpass-hdmi.h"
 
 #define LPASS_AHBIX_CLOCK_FREQUENCY		131072000
-#define LPASS_MAX_PORTS			(DISPLAY_PORT_RX_7 + 1)
+#define LPASS_MAX_PORTS			(LPASS_MAX_PORT)
 #define LPASS_MAX_MI2S_PORTS			(8)
 #define LPASS_MAX_DMA_CHANNELS			(8)
 #define LPASS_MAX_HDMI_DMA_CHANNELS		(4)
diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h
index 7ce08b401e31..189ed8a1a60d 100644
--- a/sound/soc/qcom/qdsp6/q6apm.h
+++ b/sound/soc/qcom/qdsp6/q6apm.h
@@ -16,7 +16,7 @@
 #include <linux/soc/qcom/apr.h>
 #include "audioreach.h"
 
-#define APM_PORT_MAX		127
+#define APM_PORT_MAX		LPASS_MAX_PORT
 #define APM_PORT_MAX_AUDIO_CHAN_CNT 8
 #define PCM_CHANNEL_NULL 0
 #define PCM_CHANNEL_FL    1	/* Front left channel. */
-- 
2.47.3

Re: [PATCH] ASoC: q6apm: fix array out of bounds on lpass ports

[Krzysztof Kozlowski]

On 05/02/2026 09:18, Srinivas Kandagatla wrote:
> lpass ports numbers have been added but the apm driver never got updated
> with new max port value that it uses to store dai specific data.
> 
> This will result in array out of bounds and weird driver behaviour.
> Fix this by adding a new LPASS_MAX_PORT which is can be used by driver
> instead of using number and any new port additional can only be done in
> one place, which should avoid these type of mistakes in future.
> 
> Also update the driver to use this LPASS_MAX_PORT.
> 
> Fixes: 55b5fb369c02 ("ASoC: dt-bindings: qcom,q6dsp-lpass-ports: Add USB_RX port")
> Cc: Stable@vger.kernel.org
> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
> ---
>  include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h | 1 +
>  sound/soc/qcom/lpass.h                             | 2 +-
>  sound/soc/qcom/qdsp6/q6apm.h                       | 2 +-
>  3 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
> index 6d1ce7f5da51..b4856627ad00 100644
> --- a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
> +++ b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
> @@ -140,6 +140,7 @@
>  #define DISPLAY_PORT_RX_6	134
>  #define DISPLAY_PORT_RX_7	135
>  #define USB_RX			136
> +#define LPASS_MAX_PORT		USB_RX

Not a binding. Drop from bindings.

Also, this is supposed to be separate patch with its own explanation.


Best regards,
Krzysztof

Re: [PATCH] ASoC: q6apm: fix array out of bounds on lpass ports

[Srinivas Kandagatla]

On 2/6/26 2:11 AM, Krzysztof Kozlowski wrote:
> On 05/02/2026 09:18, Srinivas Kandagatla wrote:
>> lpass ports numbers have been added but the apm driver never got updated
>> with new max port value that it uses to store dai specific data.
>>
>> This will result in array out of bounds and weird driver behaviour.
>> Fix this by adding a new LPASS_MAX_PORT which is can be used by driver
>> instead of using number and any new port additional can only be done in
>> one place, which should avoid these type of mistakes in future.
>>
>> Also update the driver to use this LPASS_MAX_PORT.
>>
>> Fixes: 55b5fb369c02 ("ASoC: dt-bindings: qcom,q6dsp-lpass-ports: Add USB_RX port")
>> Cc: Stable@vger.kernel.org
>> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
>> ---
>>  include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h | 1 +
>>  sound/soc/qcom/lpass.h                             | 2 +-
>>  sound/soc/qcom/qdsp6/q6apm.h                       | 2 +-
>>  3 files changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
>> index 6d1ce7f5da51..b4856627ad00 100644
>> --- a/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
>> +++ b/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
>> @@ -140,6 +140,7 @@
>>  #define DISPLAY_PORT_RX_6	134
>>  #define DISPLAY_PORT_RX_7	135
>>  #define USB_RX			136
>> +#define LPASS_MAX_PORT		USB_RX
> 
> Not a binding. Drop from bindings.
> 
Will fix that in next version.
> Also, this is supposed to be separate patch with its own explanation.
> 
TBH, this patch was not meant to go to public list, looks like i forgot
to add --suppress-cc as I was sending this internally for testing.

--srini

> 
> Best regards,
> Krzysztof