kernel/sound/soc/sof/ipc3-dtrace.c, branch 0x221E-v0.0.1-v6.19

ASoC: SOF: ipc3-dtrace: fix potential integer overflow in allocation

2025-09-18T21:26:31Z

Fix a potential integer overflow vulnerability in trace_filter_parse() where the allocation size calculation could overflow. The issue occurs when: 1. capacity is calculated by adding TRACE_FILTER_ELEMENTS_PER_ENTRY in a loop for each entry found in the input string. 2. capacity * sizeof(**out) multiplication could overflow if many entries are present in the input. 3. This results in a smaller allocation than expected, leading to potential buffer overflow. Replace kmalloc() with kmalloc_array() which provides built-in overflow checking and will safely fail the allocation if overflow would occur, preventing memory corruption. Signed-off-by: Samasth Norway Ananda Link: https://patch.msgid.link/20250909225111.3740029-1-samasth.norway.ananda@oracle.com Signed-off-by: Mark Brown

ASoC: SOF: Remove redundant pm_runtime_mark_last_busy() calls

2025-07-04T18:28:22Z

pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Acked-by: Peter Ujfalusi Link: https://patch.msgid.link/20250704075459.3222908-1-sakari.ailus@linux.intel.com Signed-off-by: Mark Brown

ASoC: SOF: Intel: clarify Copyright information

2024-05-06T14:59:35Z

For some reason a number of files included the "All rights reserved" statement. Good old copy-paste made sure this mistake proliferated. Remove the "All rights reserved" in all Intel-copyright to align with internal guidance. Reviewed-by: Cezary Rojewski Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20240503140359.259762-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown

ASoC: SOF: icp3-dtrace: Revert "Fix wrong kfree() usage"

2024-01-12T14:13:52Z

The offending patch introduces memory leak when there is no error, the memory allocated for the temporary storage is not freed up. As I have commented, the original code was correct and cleaner to follow but it was not obvious from the patch that it will introduce regression. Fixes: 8c91ca76f448 ("ASoC: SOF: icp3-dtrace: Fix wrong kfree() usage") Link: https://lore.kernel.org/all/aec61f67-6b4f-49e6-b458-c332983a0ad6@linux.intel.com/ Signed-off-by: Peter Ujfalusi Link: https://msgid.link/r/20240112132749.28970-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown

ASoC: SOF: icp3-dtrace: Fix wrong kfree() usage

2023-11-28T14:19:12Z

trace_filter_parse() allocs memory for *out and when -ENOMEM is returned, caller function, dfsentry_trace_filter_write() trying to freed this memory. After this patch, the memory is freed in trace_filter_parse() before -EINVAL returned. In caller function removed kfree(elms) from error label Signed-off-by: Kamil Duljas Link: https://lore.kernel.org/r/20231116220102.2097-2-kamil.duljas@gmail.com Signed-off-by: Mark Brown

ASoC: SOF: Use generic names for IPC types

2023-09-19T12:49:08Z

Use the new SOF_IPC_TYPE_3, SOF_IPC_TYPE_4 in core code. No functional changes, just renaming. Signed-off-by: Peter Ujfalusi Reviewed-by: Daniel Baluta Reviewed-by: Rander Wang Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230919104226.32239-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown

ASoC: SOF: ipc3-dtrace: Switch to memdup_user_nul() helper

2023-08-07T18:56:07Z

Use memdup_user_nul() helper instead of open-coding to simplify the code. Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20230725120247.509422-1-yangyingliang@huawei.com Signed-off-by: Mark Brown

ASoC: SOF: ipc3-dtrace: uninitialized data in dfsentry_trace_filter_write()

2023-07-17T05:15:10Z

This doesn't check how many bytes the simple_write_to_buffer() writes to the buffer. The only thing that we know is that the first byte is initialized and the last byte of the buffer is set to NUL. However the middle bytes could be uninitialized. There is no need to use simple_write_to_buffer(). This code does not support partial writes but instead passes "pos = 0" as the starting offset regardless of what the user passed as "*ppos". Just use the copy_from_user() function and initialize the whole buffer. Fixes: 671e0b90051e ("ASoC: SOF: Clone the trace code to ipc3-dtrace as fw_tracing implementation") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/74148292-ce4d-4e01-a1a7-921e6767da14@moroto.mountain Signed-off-by: Mark Brown

ASoC: SOF: Use no_reply calls for TX

2023-04-20T11:51:45Z

Convert all existing calls that pass "NULL, 0" for reply data to the new no_reply calls. Also convert any calls that pass in data but don't actually parse the result. Signed-off-by: Curtis Malainey Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20230419194057.42205-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown

ASoC: SOF: ipc3-dtrace: remove use of func in dev_dbg

2022-06-17T09:46:41Z

The module and function information can be added with 'modprobe foo dyndbg=+pmf' Suggested-by: Greg KH Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220616215351.135643-7-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown