ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH …

[ujfalusi]

…capture

When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_cfg.device_count truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent:

UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13
shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'

Treat ch_count < device_count the same way as the existing "channels equal to output reference channels" case: apply the same ch_mask to every aggregated device instead of trying to split channels that can't be evenly divided.

Fixes: 0390a10 ("ASoC: SOF: ipc4-topology: use different channel mask for each sdw amp feedback")
Cc: stable@vger.kernel.org

[Copilot]

🟢 Approval recommended

The change directly prevents the reported UBSAN shift-out-of-bounds by ensuring GENMASK(step - 1, 0) is only reached with a nonzero step, and the resulting channel-mask behavior matches the described intent.

Pull request overview

Fixes an out-of-bounds shift in the SOF IPC4 ALH aggregated topology path when the stream channel count is smaller than the number of aggregated ALH devices, by avoiding a zero step flowing into GENMASK(step - 1, 0).

Changes:

• Extend the existing “apply same channel mask to all mappings” case to also cover ch_count < blob->alh_cfg.device_count.
• Prevent GENMASK(step - 1, 0) underflow by forcing step = 0 and using mask = ch_mask in that scenario.

File summaries

File	Description
sound/soc/sof/ipc4-topology.c	Avoids step underflow/shift-OOB by applying a uniform channel mask when channels are fewer than aggregated ALH devices.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.