[PATCH v2 0/2] ASoC: codecs: lpass-{tx,wsa}-macro: fix enum kcontrol accesses

[PATCH v2 0/2] ASoC: codecs: lpass-{tx,wsa}-macro: fix enum kcontrol accesses

[Dawid Wróbel via B4 Relay]

Both drivers access enumerated controls through value.integer.value[0]
instead of value.enumerated.item[0]. The same bug was fixed in rx-macro
and va-macro in 2022 (bcfe5f76cc40, 0ea5eff7c606); tx-macro and
wsa-macro were missed.

On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value
sanity check, and every read of the affected controls fails with
-EINVAL.

Reproduced and fixed on a Xiaomi Mi Pad 5 Pro (SM8250) for tx-macro.
wsa-macro is compile-tested only — that codec is not instantiated on
this hardware.

Signed-off-by: Dawid Wróbel <me@dawidwrobel.com>
---
Changes in v2:
- wsa-macro: also fix wsa_macro_rx_mux_get() and wsa_macro_rx_mux_put(),
  which have the same bug (Srinivas Kandagatla)
- Cc stable on both patches (Srinivas Kandagatla)
- Link to v1: https://lore.kernel.org/r/20260729-worktree-lpass-tx-macro-enum-fix-v1-0-0cf02c681332@dawidwrobel.com

---
Dawid Wróbel (2):
      ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
      ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses

 sound/soc/codecs/lpass-tx-macro.c  | 4 ++--
 sound/soc/codecs/lpass-wsa-macro.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)
---
base-commit: 57b8e2d666a31fa201432d58f5fe3469a0dd83ba
change-id: 20260729-worktree-lpass-tx-macro-enum-fix-c5fbafef75b6

Best regards,
-- 
Dawid Wróbel <me@dawidwrobel.com>

[PATCH v2 1/2] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses

[Dawid Wróbel via B4 Relay]

From: Dawid Wróbel <me@dawidwrobel.com>

The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but
tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their
value through ucontrol->value.integer.value[0] (a long) instead of
ucontrol->value.enumerated.item[0] (an unsigned int).

This same pattern was fixed in the sibling drivers by
commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array
out of bounds for enum type") and
commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array
out of bounds for enum type"), but tx-macro was missed.

On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value
sanity check catches the 4 bytes written past the enumerated item
and every read of these controls fails with -EINVAL:

  snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow

Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro")
Assisted-by: Claude:claude-fable-5
Cc: stable@vger.kernel.org
Signed-off-by: Dawid Wróbel <me@dawidwrobel.com>
---
 sound/soc/codecs/lpass-tx-macro.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
index f7d168f557dd..0cbf50647ff5 100644
--- a/sound/soc/codecs/lpass-tx-macro.c
+++ b/sound/soc/codecs/lpass-tx-macro.c
@@ -1075,7 +1075,7 @@ static int tx_macro_dec_mode_get(struct snd_kcontrol *kcontrol,
 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
 	int path = e->shift_l;
 
-	ucontrol->value.integer.value[0] = tx->dec_mode[path];
+	ucontrol->value.enumerated.item[0] = tx->dec_mode[path];
 
 	return 0;
 }
@@ -1084,7 +1084,7 @@ static int tx_macro_dec_mode_put(struct snd_kcontrol *kcontrol,
 				 struct snd_ctl_elem_value *ucontrol)
 {
 	struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
-	int value = ucontrol->value.integer.value[0];
+	int value = ucontrol->value.enumerated.item[0];
 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
 	int path = e->shift_l;
 	struct tx_macro *tx = snd_soc_component_get_drvdata(component);

-- 
2.55.0

Re: [PATCH v2 1/2] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 434 bytes --]

On Thu, Jul 30, 2026 at 12:58:12PM +0200, Dawid Wróbel via B4 Relay wrote:
>   snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow
> 
> Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro")
> Assisted-by: Claude:claude-fable-5
> Cc: stable@vger.kernel.org
> Signed-off-by: Dawid Wróbel <me@dawidwrobel.com>
> ---

You had tags for this and patch 2 on v1, what happened with them?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v2 1/2] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses

[Dawid Wrobel]

On 30.07.2026 13:56, Mark Brown wrote:

> You had tags for this and patch 2 on v1, what happened with them?

Srinivas's Reviewed-by was on patch 1 of v1, I dropped it when I rewrote
the commits for v2 and didn't follow with trailers -u. That's my bad,
it's my first time with b4 and the workflow.

Patch 2 had no tag; he asked for the rx_mux fix there instead, which v2
adds, so it needs a fresh review.

Happy to resend a v3 with the patch 1's tag collected if you'd prefer.

-- 
With Kind Regards,
Dawid Wrobel

[PATCH v2 2/2] ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses

[Dawid Wróbel via B4 Relay]

From: Dawid Wróbel <me@dawidwrobel.com>

EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated,
but their get and put callbacks access the value through
ucontrol->value.integer.value[0] (a long) instead of
ucontrol->value.enumerated.item[0] (an unsigned int).

This same pattern was fixed in the sibling drivers by
commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array
out of bounds for enum type") and
commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array
out of bounds for enum type"), but wsa-macro was missed.

On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value
sanity check and every read of these controls fails with -EINVAL.

Fixes: 809bcbcecebf ("ASoC: codecs: lpass-wsa-macro: Add support to WSA Macro")
Fixes: 2c4066e5d428 ("ASoC: codecs: lpass-wsa-macro: add dapm widgets and route")
Assisted-by: Claude:claude-fable-5
Cc: stable@vger.kernel.org
Signed-off-by: Dawid Wróbel <me@dawidwrobel.com>
---
 sound/soc/codecs/lpass-wsa-macro.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c
index 5ad0448af649..af521e0988db 100644
--- a/sound/soc/codecs/lpass-wsa-macro.c
+++ b/sound/soc/codecs/lpass-wsa-macro.c
@@ -2064,7 +2064,7 @@ static int wsa_macro_ear_spkr_pa_gain_get(struct snd_kcontrol *kcontrol,
 	struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
 	struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
 
-	ucontrol->value.integer.value[0] = wsa->ear_spkr_gain;
+	ucontrol->value.enumerated.item[0] = wsa->ear_spkr_gain;
 
 	return 0;
 }
@@ -2075,7 +2075,7 @@ static int wsa_macro_ear_spkr_pa_gain_put(struct snd_kcontrol *kcontrol,
 	struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
 	struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
 
-	wsa->ear_spkr_gain =  ucontrol->value.integer.value[0];
+	wsa->ear_spkr_gain =  ucontrol->value.enumerated.item[0];
 
 	return 0;
 }
@@ -2088,7 +2088,7 @@ static int wsa_macro_rx_mux_get(struct snd_kcontrol *kcontrol,
 				snd_soc_dapm_to_component(widget->dapm);
 	struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
 
-	ucontrol->value.integer.value[0] =
+	ucontrol->value.enumerated.item[0] =
 			wsa->rx_port_value[widget->shift];
 	return 0;
 }
@@ -2101,7 +2101,7 @@ static int wsa_macro_rx_mux_put(struct snd_kcontrol *kcontrol,
 				snd_soc_dapm_to_component(widget->dapm);
 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
 	struct snd_soc_dapm_update *update = NULL;
-	u32 rx_port_value = ucontrol->value.integer.value[0];
+	u32 rx_port_value = ucontrol->value.enumerated.item[0];
 	u32 bit_input;
 	u32 aif_rst;
 	unsigned int dai_id;

-- 
2.55.0

Re: [PATCH v2 0/2] ASoC: codecs: lpass-{tx,wsa}-macro: fix enum kcontrol accesses

[Srinivas Kandagatla]

On 7/30/26 11:58 AM, Dawid Wróbel via B4 Relay wrote:
> Both drivers access enumerated controls through value.integer.value[0]
> instead of value.enumerated.item[0]. The same bug was fixed in rx-macro
> and va-macro in 2022 (bcfe5f76cc40, 0ea5eff7c606); tx-macro and
> wsa-macro were missed.
> 
> On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value
> sanity check, and every read of the affected controls fails with
> -EINVAL.
> 
> Reproduced and fixed on a Xiaomi Mi Pad 5 Pro (SM8250) for tx-macro.
> wsa-macro is compile-tested only — that codec is not instantiated on
> this hardware.
> 
> Signed-off-by: Dawid Wróbel <me@dawidwrobel.com>
> ---

LGTM,

Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>

--srini
> Changes in v2:
> - wsa-macro: also fix wsa_macro_rx_mux_get() and wsa_macro_rx_mux_put(),
>   which have the same bug (Srinivas Kandagatla)
> - Cc stable on both patches (Srinivas Kandagatla)
> - Link to v1: https://lore.kernel.org/r/20260729-worktree-lpass-tx-macro-enum-fix-v1-0-0cf02c681332@dawidwrobel.com
> 
> ---
> Dawid Wróbel (2):
>       ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
>       ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
> 
>  sound/soc/codecs/lpass-tx-macro.c  | 4 ++--
>  sound/soc/codecs/lpass-wsa-macro.c | 8 ++++----
>  2 files changed, 6 insertions(+), 6 deletions(-)
> ---
> base-commit: 57b8e2d666a31fa201432d58f5fe3469a0dd83ba
> change-id: 20260729-worktree-lpass-tx-macro-enum-fix-c5fbafef75b6
> 
> Best regards,

Re: [PATCH v2 0/2] ASoC: codecs: lpass-{tx,wsa}-macro: fix enum kcontrol accesses

[Mark Brown]

On Thu, 30 Jul 2026 12:58:11 +0200, Dawid Wróbel wrote:
> ASoC: codecs: lpass-{tx,wsa}-macro: fix enum kcontrol accesses
> 
> Both drivers access enumerated controls through value.integer.value[0]
> instead of value.enumerated.item[0]. The same bug was fixed in rx-macro
> and va-macro in 2022 (bcfe5f76cc40, 0ea5eff7c606); tx-macro and
> wsa-macro were missed.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-7.2

Thanks!

[1/2] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
      https://git.kernel.org/broonie/misc/c/1ba381759e45
[2/2] ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
      https://git.kernel.org/broonie/misc/c/56f24311fd56

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark