ALSA: hda - Add a sanity check of pin / port mapping on i915 HDMI/DP

There is an implicit rule to map between pin NID and port number on
Intel HDMI/DP codec: the mapping is fixed only for NID 0x05, 0x06 and
0x07.  For avoiding the possible memory corruption, add a sanity check
for the NID value and splat WARN_ON() for invalid accesses.

Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c
index f6854db..fb96aea 100644 (file)
--- a/sound/hda/hdac_i915.c
+++ b/sound/hda/hdac_i915.c
@@ -126,6 +126,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_get_display_clk);
  */
 static int pin2port(hda_nid_t pin_nid)
 {
+       if (WARN_ON(pin_nid < 5 || pin_nid > 7))
+               return -1;
        return pin_nid - 4;
 }
 
@@ -144,10 +146,14 @@ static int pin2port(hda_nid_t pin_nid)
 int snd_hdac_sync_audio_rate(struct hdac_bus *bus, hda_nid_t nid, int rate)
 {
        struct i915_audio_component *acomp = bus->audio_component;
+       int port;
 
        if (!acomp || !acomp->ops || !acomp->ops->sync_audio_rate)
                return -ENODEV;
-       return acomp->ops->sync_audio_rate(acomp->dev, pin2port(nid), rate);
+       port = pin2port(nid);
+       if (port < 0)
+               return -EINVAL;
+       return acomp->ops->sync_audio_rate(acomp->dev, port, rate);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_sync_audio_rate);
 
@@ -175,11 +181,15 @@ int snd_hdac_acomp_get_eld(struct hdac_bus *bus, hda_nid_t nid,
                           bool *audio_enabled, char *buffer, int max_bytes)
 {
        struct i915_audio_component *acomp = bus->audio_component;
+       int port;
 
        if (!acomp || !acomp->ops || !acomp->ops->get_eld)
                return -ENODEV;
 
-       return acomp->ops->get_eld(acomp->dev, pin2port(nid), audio_enabled,
+       port = pin2port(nid);
+       if (port < 0)
+               return -EINVAL;
+       return acomp->ops->get_eld(acomp->dev, port, audio_enabled,
                                   buffer, max_bytes);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_acomp_get_eld);