Thread (3 messages) 3 messages, 3 authors, 20d ago

Re: [PATCH v3] ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write

From: Shengjiu Wang <shengjiu.wang@gmail.com>
Date: 2026-06-04 09:37:20
Also in: linux-sound, lkml, stable

On Mon, Jun 1, 2026 at 4:33 PM [off-list ref] wrote:
From: Chancel Liu <redacted>

When configuring 32 slots TDM (channels == slots == 32), the xMR
(Mask Register) write used:
~0UL - ((1 << min(channels, slots)) - 1)

The literal "1" is a signed 32-bit int. Shifting it by 32 positions is
undefined behaviour which may set this register to 0xFFFFFFFF, masking
all 32 slots.

Use GENMASK_U32() macro instead. For 32 slots this produces a zero mask:
~GENMASK_U32(31, 0) = ~0xFFFFFFFF = 0x00000000
Behaviour for fewer than 32 slots is unchanged.

Fixes: 770f58d7d2c5 ("ASoC: fsl_sai: Support multiple data channel enable bits")
Cc: stable@vger.kernel.org
Signed-off-by: Chancel Liu <redacted>
Reviewed-by: Shengjiu Wang <shengjiu.wang@gmail.com>

Best regards
Shengjiu Wang
quoted hunk ↗ jump to hunk
---
Changes in v3
- Fix patch can't be applied

Changes in v2
- Use GENMASK_U32() macro instead to make it clearer and safer

 sound/soc/fsl/fsl_sai.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
index d6dd95680892..9661602b53c5 100644
--- a/sound/soc/fsl/fsl_sai.c
+++ b/sound/soc/fsl/fsl_sai.c
@@ -797,7 +797,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream,
                                   FSL_SAI_CR4_FSD_MSTR, FSL_SAI_CR4_FSD_MSTR);

        regmap_write(sai->regmap, FSL_SAI_xMR(tx),
-                    ~0UL - ((1 << min(channels, slots)) - 1));
+                    ~GENMASK_U32(min(channels, slots) - 1, 0));

        return 0;
 }
--
2.50.1
  
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help