[PATCH 0/2] soundwire: qcom: Fix port handling bugs

[PATCH 0/2] soundwire: qcom: Fix port handling bugs

[Srinivas Kandagatla]

This series fixes two bugs in the Qualcomm SoundWire controller driver
spotted by sashiko-bot:

1. An off-by-one in the port exhaustion check: find_first_zero_bit()
   returns the size argument (not size+1) when no free bit is found, so
   the existing `pn > maxport` guard is never true.  The driver would
   silently assign an out-of-range port instead of returning -EBUSY.

2. The sruntime[] array was sized by a hardcoded SWRM_MAX_DAIS constant
   (0xF = 15), while the actual port count comes from hardware and can
   exceed that with controllers supporting up to 17 ports.  Switch to a
   dynamic allocation at probe time so the limit tracks the hardware
   automatically.

Srinivas Kandagatla (2):
  soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
  soundwire: qcom: Allocate sruntime array dynamically

 drivers/soundwire/qcom.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

-- 
2.53.0

[PATCH 1/2] soundwire: qcom: Fix port exhaustion check in stream_alloc_ports

[Srinivas Kandagatla]

find_first_zero_bit(mask, n) returns n (not n+1) when all bits are set,
so the guard `pn > maxport` is never true on exhaustion.  The driver
would silently call set_bit(maxport, port_mask) and assign the
out-of-range port instead of returning -EBUSY.  Fix the comparison to
`pn >= maxport`.

Fixes: 02efb49aa805 ("soundwire: qcom: add support for SoundWire controller")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude Sonnet 4.6
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
---
 drivers/soundwire/qcom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
index 3d8f5a81eff1..b288218f64b4 100644
--- a/drivers/soundwire/qcom.c
+++ b/drivers/soundwire/qcom.c
@@ -1271,7 +1271,7 @@ static int qcom_swrm_stream_alloc_ports(struct qcom_swrm_ctrl *ctrl,
 				else
 					pn = find_first_zero_bit(port_mask, maxport);
 
-				if (pn > maxport) {
+				if (pn >= maxport) {
 					dev_err(ctrl->dev, "All ports busy\n");
 					return -EBUSY;
 				}
-- 
2.53.0

[PATCH 2/2] soundwire: qcom: Allocate sruntime array dynamically

[Srinivas Kandagatla]

Instead of sizing sruntime[] with a hardcoded SWRM_MAX_DAIS constant,
allocate it at probe time once the actual port count is known from
hardware.  This removes the need to keep the constant in sync with
dt-binding limits and naturally supports any future port count increase.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude Sonnet 4.6
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
---
 drivers/soundwire/qcom.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
index b288218f64b4..603f228f46b5 100644
--- a/drivers/soundwire/qcom.c
+++ b/drivers/soundwire/qcom.c
@@ -134,7 +134,6 @@
 #define TIMEOUT_MS						100
 #define QCOM_SWRM_MAX_RD_LEN					0x1
 #define DEFAULT_CLK_FREQ					9600000
-#define SWRM_MAX_DAIS						0xF
 #define SWR_INVALID_PARAM					0xFF
 #define SWR_HSTOP_MAX_VAL					0xF
 #define SWR_HSTART_MIN_VAL					0x0
@@ -215,7 +214,7 @@ struct qcom_swrm_ctrl {
 	u8 wcmd_id;
 	/* Port numbers are 1 - 14 */
 	struct qcom_swrm_port_config *pconfig;
-	struct sdw_stream_runtime *sruntime[SWRM_MAX_DAIS];
+	struct sdw_stream_runtime **sruntime;
 	enum sdw_slave_status status[SDW_MAX_DEVICES + 1];
 	int (*reg_read)(struct qcom_swrm_ctrl *ctrl, int reg, u32 *val);
 	int (*reg_write)(struct qcom_swrm_ctrl *ctrl, int reg, int val);
@@ -1384,6 +1383,10 @@ static int qcom_swrm_register_dais(struct qcom_swrm_ctrl *ctrl)
 	struct device *dev = ctrl->dev;
 	int i;
 
+	ctrl->sruntime = devm_kcalloc(dev, num_dais, sizeof(*ctrl->sruntime), GFP_KERNEL);
+	if (!ctrl->sruntime)
+		return -ENOMEM;
+
 	/* PDM dais are only tested for now */
 	dais = devm_kcalloc(dev, num_dais, sizeof(*dais), GFP_KERNEL);
 	if (!dais)
-- 
2.53.0

Re: [PATCH 0/2] soundwire: qcom: Fix port handling bugs

[Vinod Koul]

On Wed, 01 Jul 2026 20:30:04 +0100, Srinivas Kandagatla wrote:
> This series fixes two bugs in the Qualcomm SoundWire controller driver
> spotted by sashiko-bot:
> 
> 1. An off-by-one in the port exhaustion check: find_first_zero_bit()
>    returns the size argument (not size+1) when no free bit is found, so
>    the existing `pn > maxport` guard is never true.  The driver would
>    silently assign an out-of-range port instead of returning -EBUSY.
> 
> [...]

Applied, thanks!

[1/2] soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
      commit: 6ccec91c3535b07310e12d32fe9c67ff8d31d965
[2/2] soundwire: qcom: Allocate sruntime array dynamically
      commit: 4f9df964ba4507958df39612103d0eb318b1e3e5

Best regards,
-- 
~Vinod