[PATCH] ASoC: SOF: ipc3: validate extended data size before mailbox read

[Sayed Kaif <skaif@digiscrypt.com>]

ipc3_fw_parse_ext_data() reads the firmware boot extended data from the
DSP mailbox into a fixed PAGE_SIZE buffer. For each SOF_IPC_FW_READY block
it copies ext_hdr->hdr.size - sizeof(*ext_hdr) bytes into ext_data behind
the already-read header via snd_sof_dsp_block_read(), which resolves to
memcpy_fromio() with that length.

hdr.size is supplied by the DSP and is never checked. A block that declares
hdr.size larger than PAGE_SIZE overflows the ext_data heap allocation, and a
block that declares hdr.size smaller than sizeof(*ext_hdr) makes the size_t
length argument underflow to a huge value. Either case corrupts kernel
memory while parsing the firmware ready message.

Reject a block whose declared size does not fit the PAGE_SIZE buffer or is
too small to contain the header before performing the copy.

Signed-off-by: Sayed Kaif <skaif@digiscrypt.com>
---
diff --git a/sound/soc/sof/ipc3.c b/sound/soc/sof/ipc3.c
index 85bb22bbe1..72e8b827ad 100644
--- a/sound/soc/sof/ipc3.c
+++ b/sound/soc/sof/ipc3.c
@@ -598,6 +598,19 @@ static int ipc3_fw_parse_ext_data(struct snd_sof_dev *sdev, u32 offset)
 	ext_hdr = ext_data;
 
 	while (ext_hdr->hdr.cmd == SOF_IPC_FW_READY) {
+		/*
+		 * The ext data is read into the PAGE_SIZE buffer, so the
+		 * firmware-provided size must not exceed it and must be large
+		 * enough to cover the header that was already read.
+		 */
+		if (ext_hdr->hdr.size < sizeof(*ext_hdr) ||
+		    ext_hdr->hdr.size > PAGE_SIZE) {
+			dev_err(sdev->dev, "invalid ext data size 0x%x\n",
+				ext_hdr->hdr.size);
+			ret = -EINVAL;
+			break;
+		}
+
 		/* read in ext structure */
 		snd_sof_dsp_block_read(sdev, SOF_FW_BLK_TYPE_SRAM,
 				       offset + sizeof(*ext_hdr),
-- 
2.52.0