Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <Ylk5o3EC/hyX5UQ0@google.com>
In-Reply-To: <Ylk5o3EC/hyX5UQ0@google.com>
From:   Curtis Malainey <cujomalainey@google.com>
Date:   Mon, 18 Apr 2022 18:59:17 -0700
Message-ID: <CAOReqxhDpmexe_aLHb2-ESjSE2uij2SrPxRCZD3YxZm0JjtwrA@mail.gmail.com>
Subject: Re: [Sound-open-firmware] out-of-bounds access in sound/soc/sof/topology.c
To:     Sergey Senozhatsky <senozhatsky@chromium.org>
Cc:     Liam Girdwood <liam.r.girdwood@linux.intel.com>,
        Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>,
        Ranjani Sridharan <ranjani.sridharan@linux.intel.com>,
        Kai Vehmanen <kai.vehmanen@linux.intel.com>,
        ALSA development <alsa-devel@alsa-project.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Takashi Iwai <tiwai@suse.com>,
        Tomasz Figa <tfiga@chromium.org>,
        Mark Brown <broonie@kernel.org>,
        Ricardo Ribalda <ribalda@chromium.org>,
        Jaroslav Kysela <perex@perex.cz>,
        Sound Open Firmware <sound-open-firmware@alsa-project.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

> Now control data allocations looks as follows
>
>         scontrol->size = struct_size(scontrol->control_data, chanv,
>                                      le32_to_cpu(mc->num_channels));
>         scontrol->control_data = kzalloc(scontrol->size, GFP_KERNEL);
>
> Which is sizeof(sof_ipc_ctrl_data) + mc->num_channels * sizeof(sof_ipc_ctrl_value_chan)
>
> For some reason it uses sizeof(sof_ipc_ctrl_value_chan), which is not
> the largest member of the union.
>

For the record, this could be hitting as far back as 5.4 as I have
been trying to debug an invalid IPC write in JSL.