Patch "ASoC: codecs: wcd939x-sdw: Correct Soundwire ports mask" has been added to the 6.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ASoC: codecs: wcd939x-sdw: Correct Soundwire ports mask

to the 6.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     asoc-codecs-wcd939x-sdw-correct-soundwire-ports-mask.patch
and it can be found in the queue-6.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d08c3f6d6898612fa87ef117eda62c9b5de33695
Author: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx>
Date:   Fri Jul 26 16:10:43 2024 +0200

    ASoC: codecs: wcd939x-sdw: Correct Soundwire ports mask
    
    [ Upstream commit 74a79977c4e1d09eced33e6e22f875a5bb3fad29 ]
    
    Device has up to WCD939X_MAX_TX_SWR_PORTS (or WCD939X_MAX_RX_SWR_PORTS
    for sink) number of ports and the array assigned to prop.src_dpn_prop
    and prop.sink_dpn_prop has 0..WCD939X_MAX_TX_SWR_PORTS-1 elements.  On
    the other hand, GENMASK(high, low) creates an inclusive mask between
    <high, low>, so we need the mask from 0 up to WCD939X_MAX_TX_SWR_PORTS-1.
    
    Theoretically, too wide mask could cause an out of bounds read in
    sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy
    driver, e.g. adding incorrect number of ports via
    sdw_stream_add_slave().
    
    Fixes: be2af391cea0 ("ASoC: codecs: Add WCD939x Soundwire devices driver")
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx>
    Link: https://patch.msgid.link/20240726-asoc-wcd-wsa-swr-ports-genmask-v1-3-d4d7a8b56f05@xxxxxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/sound/soc/codecs/wcd939x-sdw.c b/sound/soc/codecs/wcd939x-sdw.c
index 8acb5651c5bca..392f4dcab3e09 100644
--- a/sound/soc/codecs/wcd939x-sdw.c
+++ b/sound/soc/codecs/wcd939x-sdw.c
@@ -1453,12 +1453,12 @@ static int wcd9390_probe(struct sdw_slave *pdev, const struct sdw_device_id *id)
 	pdev->prop.lane_control_support = true;
 	pdev->prop.simple_clk_stop_capable = true;
 	if (wcd->is_tx) {
-		pdev->prop.source_ports = GENMASK(WCD939X_MAX_TX_SWR_PORTS, 0);
+		pdev->prop.source_ports = GENMASK(WCD939X_MAX_TX_SWR_PORTS - 1, 0);
 		pdev->prop.src_dpn_prop = wcd939x_tx_dpn_prop;
 		wcd->ch_info = &wcd939x_sdw_tx_ch_info[0];
 		pdev->prop.wake_capable = true;
 	} else {
-		pdev->prop.sink_ports = GENMASK(WCD939X_MAX_RX_SWR_PORTS, 0);
+		pdev->prop.sink_ports = GENMASK(WCD939X_MAX_RX_SWR_PORTS - 1, 0);
 		pdev->prop.sink_dpn_prop = wcd939x_rx_dpn_prop;
 		wcd->ch_info = &wcd939x_sdw_rx_ch_info[0];
 	}