Skip to content

Commit de30f7a

Browse files
committed
ASoC: SOF: serial: fix win_offset check to use <= 0
The serial client driver stores the shell debug window slot offset as a signed ssize_t. sof_client_ipc4_find_debug_slot_offset_by_type() returns 0 when the slot is not found (not -1), so 'offset < 0' is the wrong test — a return of 0 silently bypasses the error path and causes a crash when the offset is later used in mailbox reads/writes. Fix all callers in sof-client-serial.c to use '<= 0'. Fixes: 2dedd18 ("sound: sof: add sof client driver for terminal.") Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
1 parent f9ca42c commit de30f7a

1 file changed

Lines changed: 5 additions & 5 deletions

File tree

sound/soc/sof/sof-client-serial.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ static u32 sof_serial_winstream_read(struct sof_serial_winstream *ws, u32 *seq,
189189
static int sof_serial_read_window(struct sof_serial_priv *priv, u32 rel_offset,
190190
void *dst, size_t bytes)
191191
{
192-
if (priv->win_offset < 0)
192+
if (priv->win_offset <= 0)
193193
return -ENODEV;
194194

195195
sof_client_mailbox_read(priv->cdev, priv->win_offset + rel_offset, dst, bytes);
@@ -199,7 +199,7 @@ static int sof_serial_read_window(struct sof_serial_priv *priv, u32 rel_offset,
199199
static int sof_serial_write_window(struct sof_serial_priv *priv, u32 rel_offset,
200200
const void *src, size_t bytes)
201201
{
202-
if (priv->win_offset < 0)
202+
if (priv->win_offset <= 0)
203203
return -ENODEV;
204204

205205
sof_client_mailbox_write(priv->cdev, priv->win_offset + rel_offset,
@@ -378,7 +378,7 @@ static ssize_t sof_serial_dfs_memwin_read(struct file *file, char __user *ubuf,
378378
struct sof_serial_priv *priv = cdev->data;
379379
u8 *tmp;
380380

381-
if (priv->win_offset < 0)
381+
if (priv->win_offset <= 0)
382382
return -ENODEV;
383383

384384
if (*ppos >= SOF_SERIAL_ADSP_DW_SLOT_SIZE)
@@ -411,7 +411,7 @@ static ssize_t sof_serial_dfs_memwin_write(struct file *file,
411411
struct sof_serial_priv *priv = cdev->data;
412412
u8 *tmp;
413413

414-
if (priv->win_offset < 0)
414+
if (priv->win_offset <= 0)
415415
return -ENODEV;
416416

417417
if (*ppos >= SOF_SERIAL_ADSP_DW_SLOT_SIZE)
@@ -469,7 +469,7 @@ static int sof_serial_probe(struct auxiliary_device *auxdev,
469469

470470
priv->win_offset = sof_client_ipc4_find_debug_slot_offset_by_type(cdev,
471471
SOF_SERIAL_ADSP_DW_SLOT_SHELL);
472-
if (priv->win_offset < 0) {
472+
if (priv->win_offset <= 0) {
473473
dev_err(dev, "No ADSP shell debug slot found\n");
474474
return -ENODEV;
475475
}

0 commit comments

Comments
 (0)