github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ASoC: SOF: ipc4-control: Validate notification payload size

Browse Source 
Validate MODULE_NOTIFICATION payload length before reading
bytes/channel data in control update handling.

Fixes: 2a28b5240f ("ASoC: SOF: ipc4-control: Add support for generic bytes control")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260609083458.31193-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Peter Ujfalusi 2026-06-09 11:34:54 +03:00 committed by Mark Brown
parent 3ad673e713
commit 5bdfeccb7f
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
sound/soc/sof/ipc4-control.c
View File

@ -875,6 +875,16 @@ static void sof_ipc4_control_update(struct snd_sof_dev *sdev, void *ipc_message)
*/
if (type == SND_SOC_TPLG_TYPE_BYTES) {
struct sof_abi_hdr *data = cdata->data;
size_t source_size = struct_size(msg_data, data, msg_data->num_elems);
if (source_size > ndata->event_data_size) {
dev_warn(sdev->dev,
"%s: invalid bytes notification size for %s (%zu, %u)\n",
__func__, scontrol->name, source_size,
ndata->event_data_size);
scontrol->comp_data_dirty = true;
goto notify;
}
if (msg_data->num_elems > scontrol->max_size - sizeof(*data)) {
dev_warn(sdev->dev,
@ -887,6 +897,17 @@ static void sof_ipc4_control_update(struct snd_sof_dev *sdev, void *ipc_message)
scontrol->size = sizeof(*cdata) + sizeof(*data) + data->size;
}
} else {
size_t source_size = struct_size(msg_data, chanv, msg_data->num_elems);
if (source_size > ndata->event_data_size) {
dev_warn(sdev->dev,
"%s: invalid channel notification size for %s (%zu, %u)\n",
__func__, scontrol->name, source_size,
ndata->event_data_size);
scontrol->comp_data_dirty = true;
goto notify;
}
for (i = 0; i < msg_data->num_elems; i++) {
u32 channel = msg_data->chanv[i].channel;
@ -914,6 +935,8 @@ static void sof_ipc4_control_update(struct snd_sof_dev *sdev, void *ipc_message)
scontrol->comp_data_dirty = true;
}
notify:
/*
* Look up the ALSA kcontrol of the scontrol to be able to send a
* notification to user space