github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ASoC: qcom: audioreach: fix module cfg blob size handling

Browse Source 
audioreach_get_module_priv_data() passes mod_array->size, a byte count,
as the element count of the __le32 data[] flex array. The allocation and
the copy are four times too large, and the memcpy() can read past the end
of the topology firmware buffer. The size is also never checked against
the private data it must lie within, and a zero size makes the loop spin
forever.

Convert the size to a word count, bound the blob by the remaining private
data and reject a zero size. Also check the returned pointer before
storing it in mod->data, as an error pointer there is dereferenced when
the graph is opened.

Fixes: c7ed4c2deb ("ASoC: qcom: audioreach: add support for static calibration")
Cc: stable@vger.kernel.org
Signed-off-by: Ravi Hothi <ravi.hothi@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261023171316.819857-2-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Ravi Hothi 2026-10-23 18:13:10 +01:00 committed by Mark Brown
parent e0b17f84f6
commit e21fb64a8c
1 changed files with 26 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
sound/soc/qcom/qdsp6/topology.c
View File

@ -312,22 +312,37 @@ audioreach_get_module_priv_data(const struct snd_soc_tplg_private *private)
for (sz = 0; sz < le32_to_cpu(private->size); ) {
const struct snd_soc_tplg_vendor_array *mod_array;
u32 array_size;
mod_array = (struct snd_soc_tplg_vendor_array *)((u8 *)private->array + sz);
array_size = le32_to_cpu(mod_array->size);
if (le32_to_cpu(mod_array->type) == SND_SOC_AR_TPLG_MODULE_CFG_TYPE) {
struct audioreach_module_priv_data *pdata;
u32 nwords;
pdata = kzalloc_flex(*pdata, data,
le32_to_cpu(mod_array->size));
/* size is the byte count of the __le32 data[] */
nwords = array_size / sizeof(__le32);
/* the blob must lie within the private data */
if (sizeof(*pdata) + (u64)array_size >
le32_to_cpu(private->size) - sz)
return ERR_PTR(-EINVAL);
pdata = kzalloc_flex(*pdata, data, nwords);
if (!pdata)
return ERR_PTR(-ENOMEM);
memcpy(pdata, ((u8 *)private->data + sz), struct_size(pdata, data,
le32_to_cpu(mod_array->size)));
memcpy(pdata, ((u8 *)private->data + sz),
struct_size(pdata, data, nwords));
return pdata;
}
sz = sz + le32_to_cpu(mod_array->size);
/* a zero size would never advance the walk */
if (!array_size)
return ERR_PTR(-EINVAL);
sz = sz + array_size;
}
return NULL;
@ -611,6 +626,12 @@ static int audioreach_widget_load_module_common(struct snd_soc_component *compon
return mod ? PTR_ERR(mod) : -ENODEV;
mod->data = audioreach_get_module_priv_data(&tplg_w->priv);
if (IS_ERR(mod->data)) {
int rc = PTR_ERR(mod->data);
mod->data = NULL;
return rc;
}
dobj = &w->dobj;
dobj->private = mod;