Skip to content

ipc4: helper: bound host TLV length in DMA config walk #10915

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abonislawski wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −2
Open

ipc4: helper: bound host TLV length in DMA config walk #10915

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions src/ipc/ipc4/helper.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1302,12 +1302,18 @@ int ipc4_find_dma_config(struct ipc_config_dai *dai, uint8_t *data_buffer, uint3
int ipc4_find_dma_config_multiple(struct ipc_config_dai *dai, uint8_t *data_buffer,
uint32_t size, uint32_t device_id, int dma_cfg_idx)
{
uint32_t end_addr = (uint32_t)data_buffer + size;
uintptr_t end_addr = (uintptr_t)data_buffer + size;

@jsarha jsarha Jun 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not really follow what Copilot is trying to suggest here. If the end_addr wraps, then the loop bellow will end immediately and no harm is done. The code of course does not work and function would return an error, but that is correct behaviour since the arguments are invalid.

struct ipc_dma_config *dma_cfg;
struct sof_tlv *tlvs;

for (tlvs = (struct sof_tlv *)data_buffer; tlvs && (uint32_t)tlvs < end_addr;
for (tlvs = (struct sof_tlv *)data_buffer; tlvs && (uintptr_t)tlvs < end_addr;
tlvs = tlv_next(tlvs)) {
/* Reject a host TLV that overruns the buffer or wraps tlv_next(). */
uintptr_t remaining = end_addr - (uintptr_t)tlvs;

if (remaining < sizeof(*tlvs) || tlvs->length > remaining - sizeof(*tlvs))
return IPC4_INVALID_REQUEST;

dma_cfg = tlv_value_ptr_get(tlvs, GTW_DMA_CONFIG_ID);
if (!dma_cfg)
continue;
Expand Down
Loading