target/linux/layerscape/patches-5.4/801-audio-0072-MLK-22522-ASoC-fsl_sai-fix-stack-out-of-bounds-KASAN.patch

   1 From 5d4e9c8371a2343c66123078dbde15438450b9a4 Mon Sep 17 00:00:00 2001
   2 From: Viorel Suman <viorel.suman@nxp.com>
   3 Date: Thu, 29 Aug 2019 13:17:33 +0300
   4 Subject: [PATCH] MLK-22522: ASoC: fsl_sai: fix stack-out-of-bounds KASAN
   5  complain
   6
   7 Fix the following KASAN reported issue:
   8 ==================================================================
   9 [   11.580278] BUG: KASAN: stack-out-of-bounds in find_next_bit+0x3c/0xc0
  10 [   11.586815] Read of size 8 at addr ffffffc8c8d4f760 by task swapper/0/1
  11 [   11.593440]
  12 [   11.594943] CPU: 4 PID: 1 Comm: swapper/0 Tainted: G W 4.19.35-05042-g. #157
  13 [   11.604259] Hardware name: Freescale i.MX8QM MEK (DT)
  14 [   11.609323] Call trace:
  15 [   11.611785]  dump_backtrace+0x0/0x230
  16 [   11.615458]  show_stack+0x14/0x20
  17 [   11.618787]  dump_stack+0xbc/0xf4
  18 [   11.622118]  print_address_description+0x60/0x270
  19 [   11.626830]  kasan_report+0x230/0x360
  20 [   11.630505]  __asan_load8+0x84/0xa8
  21 [   11.634005]  find_next_bit+0x3c/0xc0
  22 [   11.637595]  fsl_sai_calc_dl_off+0x1c/0x50
  23 [   11.641703]  fsl_sai_read_dlcfg+0x184/0x368
  24 [   11.645898]  fsl_sai_probe+0x3ec/0xb48
  25 [   11.649663]  platform_drv_probe+0x70/0xd8
  26 [   11.653683]  really_probe+0x24c/0x370
  27 [   11.657358]  driver_probe_device+0x70/0x138
  28 [   11.661554]  __driver_attach+0x124/0x128
  29 [   11.665489]  bus_for_each_dev+0xe8/0x158
  30 [   11.669425]  driver_attach+0x30/0x40
  31 [   11.673012]  bus_add_driver+0x290/0x308
  32 [   11.676861]  driver_register+0xbc/0x1d0
  33 [   11.680711]  __platform_driver_register+0x7c/0x88
  34 [   11.685431]  fsl_sai_driver_init+0x18/0x20
  35 [   11.689537]  do_one_initcall+0xe8/0x5a8
  36 [   11.693387]  kernel_init_freeable+0x6b0/0x760
  37 [   11.697759]  kernel_init+0x10/0x120
  38 [   11.701255]  ret_from_fork+0x10/0x18
  39 ....
  40 ==================================================================
  41 [   11.800186] Disabling lock debugging due to kernel taint
  42
  43 Signed-off-by: Viorel Suman <viorel.suman@nxp.com>
  44 Reviewed-by: Shengjiu Wang <shengjiu.wang@nxp.com>
  45 ---
  46  sound/soc/fsl/fsl_sai.c | 10 +++++-----
  47  1 file changed, 5 insertions(+), 5 deletions(-)
  48
  49 --- a/sound/soc/fsl/fsl_sai.c
  50 +++ b/sound/soc/fsl/fsl_sai.c
  51 @@ -1259,12 +1259,12 @@ static const struct of_device_id fsl_sai
  52  };
  53  MODULE_DEVICE_TABLE(of, fsl_sai_ids);
  54
  55 -static unsigned int fsl_sai_calc_dl_off(unsigned int* dl_mask)
  56 +static unsigned int fsl_sai_calc_dl_off(unsigned long dl_mask)
  57  {
  58         int fbidx, nbidx, offset;
  59
  60 -       fbidx = find_first_bit((const unsigned long *)dl_mask, 8);
  61 -       nbidx = find_next_bit((const unsigned long *)dl_mask, 8, fbidx+1);
  62 +       fbidx = find_first_bit(&dl_mask, 8);
  63 +       nbidx = find_next_bit(&dl_mask, 8, fbidx + 1);
  64         offset = nbidx - fbidx - 1;
  65
  66         return (offset < 0 || offset >= 7 ? 0 : offset);
  67 @@ -1321,9 +1321,9 @@ static int fsl_sai_read_dlcfg(struct pla
  68
  69                 cfg[i].pins = pins;
  70                 cfg[i].mask[0] = rx;
  71 -               cfg[i].offset[0] = fsl_sai_calc_dl_off(&rx);
  72 +               cfg[i].offset[0] = fsl_sai_calc_dl_off(rx);
  73                 cfg[i].mask[1] = tx;
  74 -               cfg[i].offset[1] = fsl_sai_calc_dl_off(&tx);
  75 +               cfg[i].offset[1] = fsl_sai_calc_dl_off(tx);
  76         }
  77
  78         *rcfg = cfg;