Skip to contentSkip to conversation

ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()

PATCH Applied Gustavo A. R. Silva 3 participants 8 messages Sep 15, 2023 – Oct 2, 2023

Subsystems (3)
Sound ASoC Sound - sound open firmware (SOF) drivers
lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()

If, for any reason, the open-coded arithmetic causes a wraparound, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

Fixes f9efae954905 ("ASoC: SOF: ipc4-topology: Add support for base config extension")
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 sound/soc/sof/ipc4-topology.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/sof/ipc4-topology.c +2 -1
index f2a30cd31378..2a19dd022aaf 100644
@@ -895,7 +895,8 @@ static int sof_ipc4_widget_setup_comp_process(struct snd_sof_widget *swidget)
 	if (process->init_config == SOF_IPC4_MODULE_INIT_CONFIG_TYPE_BASE_CFG_WITH_EXT) {
 		struct sof_ipc4_base_module_cfg_ext *base_cfg_ext;
 		u32 ext_size = struct_size(base_cfg_ext, pin_formats,
-						swidget->num_input_pins + swidget->num_output_pins);
+					   size_add(swidget->num_input_pins,
+						    swidget->num_output_pins));
 
 		base_cfg_ext = kzalloc(ext_size, GFP_KERNEL);
 		if (!base_cfg_ext) {
Signature · 1 line
2.34.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 7 lines · Gustavo A. R. Silva

If, for any reason, the open-coded arithmetic causes a wraparound, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

Fixes f9efae954905 ("ASoC: SOF: ipc4-topology: Add support for base config extension")
Signed-off-by Gustavo A. R. Silva <[email protected]>
Reviewed-by Kees Cook <[email protected]>
Signature · 1 line
Kees Cook
Applied
#2 lore raw
In reply to Gustavo A. R. Silva
Quoted 6 lines · Gustavo A. R. Silva

If, for any reason, the open-coded arithmetic causes a wraparound, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

Applied to for-next/hardening, thanks!

[1/1] ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()

      https://git.kernel.org/kees/c/93d2858dd630

Take care,

Signature · 1 line
Kees Cook
maintainer
#3 lore raw
Quoted 9 lines · Kees Cook
Quoted 4 lines · Gustavo A. R. Silva

If, for any reason, the open-coded arithmetic causes a wraparound, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

[1/1] ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()

      https://git.kernel.org/kees/c/93d2858dd630

Why is this bypassing the ASoC tree?

#4 lore raw
Quoted 8 lines · Mark Brown
Quoted 6 lines · Kees Cook
Quoted 4 lines · Gustavo A. R. Silva

If, for any reason, the open-coded arithmetic causes a wraparound, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

Quoted 4 lines
Quoted 2 lines

[1/1] ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()

      https://git.kernel.org/kees/c/93d2858dd630

Why is this bypassing the ASoC tree?

Hi! Sorry, I can drop it if you want to take it? I tend to collect trivial hardening changes with reviews that haven't been otherwise commented on for at least 2 weeks.

-Kees

Signature · 1 line
Kees Cook
maintainer
#5 lore raw
Quoted 7 lines · Kees Cook
Quoted 1 line · Mark Brown

Why is this bypassing the ASoC tree?

Hi! Sorry, I can drop it if you want to take it? I tend to collect trivial hardening changes with reviews that haven't been otherwise commented on for at least 2 weeks.

Yes, it's in my queue - 2 weeks is really rather fast between people not being available and waiting for driver authors to review if they normally look at things.

maintainer
#6 lore raw
In reply to Gustavo A. R. Silva
Quoted 6 lines · Gustavo A. R. Silva

If, for any reason, the open-coded arithmetic causes a wraparound, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

Applied to

https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next

Thanks!

[1/1] ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()

      commit: 3746284c233d5cf5f456400e61cd4a46a69c6e8c

All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying to this mail.

Thanks,
Mark

#7 lore raw
Quoted 8 lines · Mark Brown
Quoted 6 lines · Gustavo A. R. Silva

If, for any reason, the open-coded arithmetic causes a wraparound, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

Quoted 8 lines

Applied to

https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next

Thanks!

[1/1] ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()

      commit: 3746284c233d5cf5f456400e61cd4a46a69c6e8c

Thanks! I've dropped it from my tree.

-Kees

Signature · 1 line
Kees Cook