[PATCH] ALSA: hda/core: Stop capability walk on empty capability header

[PATCH] ALSA: hda/core: Stop capability walk on empty capability header

[Michał Kopeć]

From: Michal Kopec <michal.kopec@3mdeb.com>

snd_hdac_bus_parse_capabilities() walks the controller's linked
capability list starting at LLCH. On some platforms one of the entries
reads back as all zeros. Such a header does not describe a capability,
but the walk still treats it as one: it falls into the default case and
reports an error, printing the raw register value instead of the
capability ID:

  snd_hda_intel 0000:00:1f.3: Unknown capability 0

The walk then stops anyway, because the next pointer of a zero header
is 0, so the message is only noise.

Treat an all-zero header as the end of the list, the same way a failed
read (-1) is already handled, and log it at debug level only. Also
print the capability ID in hex for a genuinely unknown capability,
instead of the full header value.

Fixes: 0b00a5615dc4 ("ALSA: hdac_ext: add hdac extended controller")
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
---
 sound/hda/core/controller.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sound/hda/core/controller.c b/sound/hda/core/controller.c
index a7acd3418ae8..52deaa9f1a91 100644
--- a/sound/hda/core/controller.c
+++ b/sound/hda/core/controller.c
@@ -445,6 +445,13 @@ int snd_hdac_bus_parse_capabilities(struct hdac_bus *bus)
 			break;
 		}
 
+		/* An all-zero header means no capability is present here */
+		if (!cur_cap) {
+			dev_dbg(bus->dev, "Empty capability header at offset 0x%x\n",
+				offset);
+			break;
+		}
+
 		switch ((cur_cap & AZX_CAP_HDR_ID_MASK) >> AZX_CAP_HDR_ID_OFF) {
 		case AZX_ML_CAP_ID:
 			dev_dbg(bus->dev, "Found ML capability\n");
@@ -475,7 +482,8 @@ int snd_hdac_bus_parse_capabilities(struct hdac_bus *bus)
 			break;
 
 		default:
-			dev_err(bus->dev, "Unknown capability %d\n", cur_cap);
+			dev_err(bus->dev, "Unknown capability ID 0x%x\n",
+				(cur_cap & AZX_CAP_HDR_ID_MASK) >> AZX_CAP_HDR_ID_OFF);
 			cur_cap = 0;
 			break;
 		}
-- 
2.56.0

Re: [PATCH] ALSA: hda/core: Stop capability walk on empty capability header

[Takashi Iwai]

On Mon, 02 Nov 2026 12:49:39 +0100,
Michał Kopeć wrote:
> 
> From: Michal Kopec <michal.kopec@3mdeb.com>
> 
> snd_hdac_bus_parse_capabilities() walks the controller's linked
> capability list starting at LLCH. On some platforms one of the entries
> reads back as all zeros. Such a header does not describe a capability,
> but the walk still treats it as one: it falls into the default case and
> reports an error, printing the raw register value instead of the
> capability ID:
> 
>   snd_hda_intel 0000:00:1f.3: Unknown capability 0
> 
> The walk then stops anyway, because the next pointer of a zero header
> is 0, so the message is only noise.
> 
> Treat an all-zero header as the end of the list, the same way a failed
> read (-1) is already handled, and log it at debug level only. Also
> print the capability ID in hex for a genuinely unknown capability,
> instead of the full header value.
> 
> Fixes: 0b00a5615dc4 ("ALSA: hdac_ext: add hdac extended controller")
> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>

Applied now.  Thanks.


Takashi