audio: copier: bound ALH mapping count to the gateway config size - #11046
Open
tmleman wants to merge 1 commit into
Open
audio: copier: bound ALH mapping count to the gateway config size#11046tmleman wants to merge 1 commit into
tmleman wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens IPC4 ALH gateway configuration parsing in copier_alh_assign_dai_index() by validating that the host-supplied gateway config blob is large enough before reading count and walking mapping[], preventing out-of-bounds reads and related size/arithmetic issues when given malformed or fuzzed blobs.
Changes:
- Adds upfront validation that the blob contains the fixed ALH header before reading/logging
alh_cfg.count. - Bounds
alh_cfg.countagainst both the array limit and the actual blob size viaget_alh_config_size()checks. - Improves early rejection of malformed blobs to avoid downstream underflow / OOB access patterns.
Comment on lines
+89
to
+101
| blob_size = (size_t)cd->config.gtw_cfg.config_length << 2; | ||
| if (blob_size < sizeof(alh_blob->gtw_attributes) + sizeof(alh_blob->alh_cfg.count)) { | ||
| comp_err(mod->dev, "Invalid ALH gateway config: blob=%u bytes", | ||
| (uint32_t)blob_size); | ||
| return -EINVAL; | ||
| } | ||
|
|
||
| alh_count = alh_blob->alh_cfg.count; | ||
| if (alh_count > IPC4_ALH_MAX_NUMBER_OF_GTW || | ||
| get_alh_config_size(alh_blob) > blob_size) { | ||
| comp_err(mod->dev, "Invalid ALH gateway config: count=%u, blob=%u bytes", | ||
| alh_count, (uint32_t)blob_size); | ||
| return -EINVAL; |
copier_alh_assign_dai_index() reads alh_cfg.count from the host-supplied gateway config blob and walks alh_cfg.mapping[0..count). count is only clamped to the mapping[] array size (IPC4_ALH_MAX_NUMBER_OF_GTW), never to the actual blob size, so a blob that advertises more mappings than it holds makes the walk read past the config_data allocation. The same unchecked count also underflows dma_config_length in the HDA branch (config_length * 4 - get_alh_config_size()). A fuzzer-crafted IPC4 copier init (config_length=13 -> 52-byte blob, count=15 -> 128 bytes needed) triggers a heap out-of-bounds read reported by AddressSanitizer at the SOF_DAI_INTEL_ALH mapping[] load. Validate up front that the blob holds the fixed header (so count can be read safely), that count is within the array bound, and that get_alh_config_size() fits in the blob before touching mapping[]. Valid ALH/HDA blobs are unaffected. This completes the earlier count guards by bounding count against the actual blob size. Also reject a gateway blob shorter than the fixed ALH header before reading or logging alh_cfg.count. Although the original compound check short-circuited the count validation safely, its error message still dereferenced count for a truncated blob. Capture and report count only after the header-size check succeeds. Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>
lgirdwood
reviewed
Jul 30, 2026
lgirdwood
left a comment
lgirdwood
left a comment
Member
There was a problem hiding this comment.
Just one open from copilot.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
copier_alh_assign_dai_index() reads alh_cfg.count from the host-supplied gateway config blob and walks alh_cfg.mapping[0..count). count is only clamped to the mapping[] array size (IPC4_ALH_MAX_NUMBER_OF_GTW), never to the actual blob size, so a blob that advertises more mappings than it holds makes the walk read past the config_data allocation. The same unchecked count also underflows dma_config_length in the HDA branch (config_length * 4 - get_alh_config_size()).
A fuzzer-crafted IPC4 copier init (config_length=13 -> 52-byte blob, count=15 -> 128 bytes needed) triggers a heap out-of-bounds read reported by AddressSanitizer at the SOF_DAI_INTEL_ALH mapping[] load.
Validate up front that the blob holds the fixed header (so count can be read safely), that count is within the array bound, and that get_alh_config_size() fits in the blob before touching mapping[]. Valid ALH/HDA blobs are unaffected. This completes the earlier count guards by bounding count against the actual blob size.
Also reject a gateway blob shorter than the fixed ALH header before reading or logging alh_cfg.count. Although the original compound check short-circuited the count validation safely, its error message still dereferenced count for a truncated blob. Capture and report count only after the header-size check succeeds.