On Tue, Jul 21, 2026 at 10:26 AM Daniel Golle <[email protected]> wrote: > > it6505->audio.channel_count is zero from allocation until either DP > link training has run once (it6505_variable_config()) or a valid > hw_params call has cached a channel count. it6505_enable_audio() can > be reached before either of those has happened, e.g. from the > audio-FIFO-error IRQ, which is unmasked unconditionally at poweron. > it6505_enable_audio_infoframe() then indexes the 8-entry > audio_info_ca[] table with channel_count - 1, an out-of-bounds stack > read when channel_count is still 0. > > Bail out of it6505_enable_audio_infoframe() when channel_count is not > yet known instead of indexing with it. > > While here, fix the debug print in it6505_audio_setup_hw_params(): on > the invalid-channel-count path it logged the previously cached > channel_count instead of the actually-rejected params->cea.channels. > > Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") > Signed-off-by: Daniel Golle <[email protected]>
Reviewed-by: Chen-Yu Tsai <[email protected]>
