ASoC: SOF: ipc3-control: Reject ABI data size larger than the TLV pay… - #5871
Open
ujfalusi wants to merge 1 commit into
Open
ASoC: SOF: ipc3-control: Reject ABI data size larger than the TLV pay…#5871ujfalusi wants to merge 1 commit into
ujfalusi wants to merge 1 commit into
Conversation
ujfalusi
requested review from
bardliao,
dbaluta,
kv2019i,
lgirdwood,
plbossart and
ranj063
as code owners
August 7, 2026 08:04
…load sof_ipc3_bytes_ext_put() copies header.length bytes from user space into cdata->data, but the amount of payload later sent to the firmware is taken from the ABI header's own size field. Nothing checks that the two agree, so a user claiming a size larger than the data it actually provided makes the driver send the stale tail of the previous control value to the DSP. The same stale tail is returned to user space by a subsequent bytes_ext_get() that does not read back from the DSP. Reject the payload if the ABI size field exceeds the data available in the TLV block. header.length has already been verified to be at least sizeof(struct sof_abi_hdr), so the subtraction cannot underflow. Fixes: 67ec2a0 ("ASoC: SOF: Add bytes_ext control IPC ops for IPC3") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
There was a problem hiding this comment.
Pull request overview
This PR hardens the SOF IPC3 bytes_ext control write path against mismatched size fields that could cause stale tail bytes from a previous control value to be sent to the DSP (and later echoed back to userspace without a DSP readback).
Changes:
- Computes the TLV payload size (excluding
struct sof_abi_hdr) fromheader.length. - Rejects writes where
sof_abi_hdr.sizeexceeds the bytes actually provided in the TLV block, preventing stale data from being transmitted/returned.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
bardliao
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…load
sof_ipc3_bytes_ext_put() copies header.length bytes from user space into cdata->data, but the amount of payload later sent to the firmware is taken from the ABI header's own size field. Nothing checks that the two agree, so a user claiming a size larger than the data it actually provided makes the driver send the stale tail of the previous control value to the DSP. The same stale tail is returned to user space by a subsequent bytes_ext_get() that does not read back from the DSP.
Reject the payload if the ABI size field exceeds the data available in the TLV block. header.length has already been verified to be at least sizeof(struct sof_abi_hdr), so the subtraction cannot underflow.
Fixes: 67ec2a0 ("ASoC: SOF: Add bytes_ext control IPC ops for IPC3")
Cc: stable@vger.kernel.org