Commit 29218a4d11a3 for kernel

commit 29218a4d11a31a8157389bc2b9e62dd768d7ea42
Author: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Date:   Thu Sep 10 21:46:46 2026 +0530

    ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers

    Add a bounds check in create_sdw_dailink() to validate that the
    SoundWire link ID derived from link_mask does not exceed the maximum
    supported by the platform. If the link ID is out of range or link_mask
    is zero, log an error and return -EINVAL to prevent accessing invalid
    CPU pin ID tables.

    Applied to both acp-sdw-sof-mach.c and acp-sdw-legacy-mach.c.

    Fixes: 6d8348ddc56e ("ASoC: amd: acp: refactor SoundWire machine driver code")
    Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
    Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
    Link: https://patch.msgid.link/20260910161728.1452808-2-Vijendar.Mukunda@amd.com
    Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/amd/acp/acp-sdw-legacy-mach.c b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
index 6eac42bac855..2ea226a195c3 100644
--- a/sound/soc/amd/acp/acp-sdw-legacy-mach.c
+++ b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
@@ -205,6 +205,16 @@ static int create_sdw_dailink(struct snd_soc_card *card,
 			return -EINVAL;
 		}

+		if (!soc_end->link_mask) {
+			dev_err(dev, "invalid zero link_mask\n");
+			return -EINVAL;
+		}
+		if ((ffs(soc_end->link_mask) - 1) >= amd_ctx->max_sdw_links) {
+			dev_err(dev, "link_id %d exceeds max_sdw_links %d\n",
+				ffs(soc_end->link_mask) - 1, amd_ctx->max_sdw_links);
+			return -EINVAL;
+		}
+
 		switch (amd_ctx->acp_rev) {
 		case ACP63_PCI_REV:
 			ret = get_acp63_cpu_pin_id(ffs(soc_end->link_mask - 1),
diff --git a/sound/soc/amd/acp/acp-sdw-sof-mach.c b/sound/soc/amd/acp/acp-sdw-sof-mach.c
index a9cd1f335167..6c74e67b134f 100644
--- a/sound/soc/amd/acp/acp-sdw-sof-mach.c
+++ b/sound/soc/amd/acp/acp-sdw-sof-mach.c
@@ -121,6 +121,15 @@ static int create_sdw_dailink(struct snd_soc_card *card,
 			return -EINVAL;
 		}

+		if (!sof_end->link_mask) {
+			dev_err(dev, "invalid zero link_mask\n");
+			return -EINVAL;
+		}
+		if ((ffs(sof_end->link_mask) - 1) >= amd_ctx->max_sdw_links) {
+			dev_err(dev, "link_id %d exceeds max_sdw_links %d\n",
+				ffs(sof_end->link_mask) - 1, amd_ctx->max_sdw_links);
+			return -EINVAL;
+		}
 		switch (amd_ctx->acp_rev) {
 		case ACP63_PCI_REV:
 			ret = get_acp63_cpu_pin_id(ffs(sof_end->link_mask - 1),