audio: module_adapter_ipc4: add range check to module_set_large_config() - #11044
Open
tmleman wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens IPC4 module adapter large-configuration handling by rejecting oversized single-fragment SET_LARGE_CONFIG payloads to prevent mailbox source over-reads during module configuration updates.
Changes:
- Add a range check in
module_set_large_config()to reject single-fragment payload sizes larger thanMAILBOX_HOSTBOX_SIZE. - Emit an error and return
-EINVALon invalid single-fragment sizes.
Comment on lines
239
to
+243
| case MODULE_CFG_FRAGMENT_SINGLE: | ||
| if (data_offset_size > MAILBOX_HOSTBOX_SIZE) { | ||
| comp_err(dev, "invalid large_config fragment size %u", data_offset_size); | ||
| return -EINVAL; | ||
| } |
module_set_large_config() reads a SET_LARGE_CONFIG payload out of the fixed-size HOSTBOX mailbox. For a single-fragment config (init_block && final_block) the number of bytes copied, fragment_size, is set verbatim to the host-controlled data_off_size (a 20-bit field, up to ~1 MB), without bounding it to the mailbox. The .set_configuration handler (e.g. comp_data_blob_set() -> memcpy_s()) then copies that many bytes from the ~4 KB mailbox; memcpy_s() only validates the destination size, so the source over-read is not caught and reads past MAILBOX_HOSTBOX_BASE. A fuzzer-crafted request (data_off_size = 64778 from a 4096-byte mailbox) triggers a global-buffer-overflow read reported by AddressSanitizer. Reject a single fragment larger than MAILBOX_HOSTBOX_SIZE, mirroring the range check already present on the GET path (commit f72dbb2) and the mailbox bound used at module init. Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
module_set_large_config() reads a SET_LARGE_CONFIG payload out of the fixed-size HOSTBOX mailbox. For a single-fragment config (init_block && final_block) the number of bytes copied, fragment_size, is set verbatim to the host-controlled data_off_size (a 20-bit field, up to ~1 MB), without bounding it to the mailbox. The .set_configuration handler (e.g. comp_data_blob_set() -> memcpy_s()) then copies that many bytes from the ~4 KB mailbox; memcpy_s() only validates the destination size, so the source over-read is not caught and reads past MAILBOX_HOSTBOX_BASE.
A fuzzer-crafted request (data_off_size = 64778 from a 4096-byte mailbox) triggers a global-buffer-overflow read reported by AddressSanitizer.
Reject a single fragment larger than MAILBOX_HOSTBOX_SIZE, mirroring the range check already present on the GET path (commit f72dbb2) and the mailbox bound used at module init.