From e796d8599132a4abe91899064241959217765293 Mon Sep 17 00:00:00 2001 From: Jun Lai Date: Wed, 21 Oct 2026 18:11:45 +0800 Subject: [PATCH] ipc4: handler: bound large config get reply size For a LARGE_CONFIG_GET the reply size starts as the host-controlled 20-bit data_off_size field and is only updated if the module's get_configuration() writes it back. Modules that do not (e.g. the selector, whose getter is a stub returning 0) leave it untouched, so up to ~1 MB ends up in msg_reply->tx_size. Writing that reply to the 4 KB DSP mailbox then fails in memcpy_s(). On the POSIX/fuzz platform this trips an assert inside the IPC TX work queue, whose handler re-asserts while holding a spinlock and recurses until the 2 KB thread stack overflows. The IPC fuzzer reported this as an AddressSanitizer stack-overflow. Reject reply sizes larger than MAILBOX_DSPBOX_SIZE with IPC4_INVALID_CONFIG_DATA_STRUCT in both large config get paths. Signed-off-by: Jun Lai Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/ipc/ipc4/handler-user.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/ipc/ipc4/handler-user.c b/src/ipc/ipc4/handler-user.c index 8aee53d382b3..7ea48bd4b194 100644 --- a/src/ipc/ipc4/handler-user.c +++ b/src/ipc/ipc4/handler-user.c @@ -1184,6 +1184,12 @@ __cold static int ipc4_process_large_config_get(struct ipc4_message_request *ipc if (ret) return ret; + /* A module must not report more reply data than the DSP mailbox can hold. */ + if (data_offset > MAILBOX_DSPBOX_SIZE) { + ipc_cmd_err(&ipc_tr, "reply size %u exceeds mailbox bound", data_offset); + return IPC4_INVALID_CONFIG_DATA_STRUCT; + } + /* Output via parameters instead of msg_reply */ *reply_ext = reply.extension.dat; *reply_tx_size = data_offset; @@ -1292,6 +1298,12 @@ __cold static int ipc4_get_large_config_module_instance(struct ipc4_message_requ if (ret) return ret; + /* A module must not report more reply data than the DSP mailbox can hold. */ + if (data_offset > MAILBOX_DSPBOX_SIZE) { + ipc_cmd_err(&ipc_tr, "reply size %u exceeds mailbox bound", data_offset); + return IPC4_INVALID_CONFIG_DATA_STRUCT; + } + msg_reply->extension = reply.extension.dat; msg_reply->tx_size = data_offset; msg_reply->tx_data = data;