Patch "ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers" has been added to the 6.13-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers

to the 6.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     asoc-sof-ipc4-topology-harden-loops-for-looking-up-a.patch
and it can be found in the queue-6.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ea11353b740ca74abe1b533c1e273fc7d6f74c27
Author: Peter Ujfalusi <peter.ujfalusi@xxxxxxxxxxxxxxx>
Date:   Thu Feb 6 10:46:42 2025 +0200

    ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
    
    [ Upstream commit 6fd60136d256b3b948333ebdb3835f41a95ab7ef ]
    
    Other, non DAI copier widgets could have the same  stream name (sname) as
    the ALH copier and in that case the copier->data is NULL, no alh_data is
    attached, which could lead to NULL pointer dereference.
    We could check for this NULL pointer in sof_ipc4_prepare_copier_module()
    and avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai()
    will miscalculate the ALH device count, causing broken audio.
    
    The correct fix is to harden the matching logic by making sure that the
    1. widget is a DAI widget - so dai = w->private is valid
    2. the dai (and thus the copier) is ALH copier
    
    Fixes: a150345aa758 ("ASoC: SOF: ipc4-topology: add SoundWire/ALH aggregation support")
    Reported-by: Seppo Ingalsuo <seppo.ingalsuo@xxxxxxxxxxxxxxx>
    Link: https://github.com/thesofproject/sof/pull/9652
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@xxxxxxxxxxxxxxx>
    Reviewed-by: Liam Girdwood <liam.r.girdwood@xxxxxxxxx>
    Reviewed-by: Ranjani Sridharan <ranjani.sridharan@xxxxxxxxxxxxxxx>
    Reviewed-by: Bard Liao <yung-chuan.liao@xxxxxxxxxxxxxxx>
    Link: https://patch.msgid.link/20250206084642.14988-1-peter.ujfalusi@xxxxxxxxxxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c
index b55eb977e443d..70b7bfb080f47 100644
--- a/sound/soc/sof/ipc4-topology.c
+++ b/sound/soc/sof/ipc4-topology.c
@@ -765,10 +765,16 @@ static int sof_ipc4_widget_setup_comp_dai(struct snd_sof_widget *swidget)
 		}
 
 		list_for_each_entry(w, &sdev->widget_list, list) {
-			if (w->widget->sname &&
+			struct snd_sof_dai *alh_dai;
+
+			if (!WIDGET_IS_DAI(w->id) || !w->widget->sname ||
 			    strcmp(w->widget->sname, swidget->widget->sname))
 				continue;
 
+			alh_dai = w->private;
+			if (alh_dai->type != SOF_DAI_INTEL_ALH)
+				continue;
+
 			blob->alh_cfg.device_count++;
 		}
 
@@ -2061,11 +2067,13 @@ sof_ipc4_prepare_copier_module(struct snd_sof_widget *swidget,
 			list_for_each_entry(w, &sdev->widget_list, list) {
 				u32 node_type;
 
-				if (w->widget->sname &&
+				if (!WIDGET_IS_DAI(w->id) || !w->widget->sname ||
 				    strcmp(w->widget->sname, swidget->widget->sname))
 					continue;
 
 				dai = w->private;
+				if (dai->type != SOF_DAI_INTEL_ALH)
+					continue;
 				alh_copier = (struct sof_ipc4_copier *)dai->private;
 				alh_data = &alh_copier->data;
 				node_type = SOF_IPC4_GET_NODE_TYPE(alh_data->gtw_cfg.node_id);