Re: [PATCH v3 18/26] ASoC: SOF: ipc4/ipc4-loader: Add SOF_INFO and CODEC_INFO to fw_config_params

["Péter Ujfalusi" <peter.ujfalusi@linux.intel.com>]

On 12/09/2026 00:01, Mark Brown wrote:
> On Fri, Sep 11, 2026 at 02:21:44PM +0300, Peter Ujfalusi wrote:
> 
>> +static int sof_ipc4_query_sof_info(struct snd_sof_dev *sdev,
>> +				   void *sof_info_data, u32 sof_info_size)
>> +{
>> +	struct sof_ipc4_fw_data *ipc4_data = sdev->private;
>> +	struct sof_ipc4_tuple *tuple;
>> +	size_t tuple_size;
>> +	size_t offset = 0;
>> +	int ret = 0;
> 
>> +	while (offset < sof_info_size) {
> 
>> +		tuple = (struct sof_ipc4_tuple *)((u8 *)sof_info_data + offset);
>> +		tuple_size = sizeof(*tuple) + tuple->size;
>> +		if (tuple_size < sizeof(*tuple) || tuple_size > sof_info_size - offset) {
> 
> tuple->size can be 0...

It cannot be 0, the tuples are built in firmware and they are guarantied
to be correct.

I guess I have added this check based on comments, but I would rather
remove them.

s for the specific CODEC_INFO, it is also granted that the tuple->size
is not 0:
https://github.com/thesofproject/sof/blob/main/src/audio/base_fw.c#L111

In fact, all tuples are added in a way that the size cannot be 0, but
the check in the code is incorrect, it should be:
if (!tuple->size || tuple_size > sof_info_size - offset) {


> 
>> +		switch (tuple->type) {
>> +		case SOF_IPC4_SOF_CODEC_INFO:
>> +			ipc4_data->codec_info = devm_kmemdup(sdev->dev, tuple->value,
>> +							     tuple->size, GFP_KERNEL);
> 
> ...and devm_kmemdup() of 0 returns ZERO_SIZE_PTR which crucially is not
> NULL so things that later check that codec_info is set see that it is
> and try to dereference it.  We should probably also check that the count
> in the codec_info isn't oveflowing the buffer.

We trust  the firmware provided information. If we cannot trust that
then we cannot trust on the size / count it provides either and there is
nothing that we can validate.

We don't have tuple size checking for fw_config or hw_config either.

To have a compromised fw booted it involves obtaining a secret signing
key to sign the compromised fw and a root access to actually deploy to
the system.

-- 
Péter