[PATCH v2 0/2] ASoC: SOF: xtensa: prevent stack OOB read on DSP panic

[PATCH v2 0/2] ASoC: SOF: xtensa: prevent stack OOB read on DSP panic

[Ștefan Ghețu]

This series fixes a stack out-of-bounds read affecting all platforms
that dump DSP oops/panic info via sof_print_oops_and_stack() (i.MX,
AMD, Intel atom/bdw/hda-dsp, MediaTek).

Commit 58bb5081cba1 ("ASoC: SOF: Xtensa: dump ar registers to restore
call stack") added a loop that walks the flexible array member ar[]
in struct sof_ipc_dsp_oops_xtensa, using plat_hdr.numaregs (a
firmware-supplied, unbounded count) as the element count. This only
works correctly for callers that allocate room for ar[], such as the
Intel IPC4 path. The IPC3 callers listed below allocate xoops on the
stack with no room for ar[], and were not updated when the loop was
added, so numaregs walks past the buffer.

Patch 1/2 fixes the i.MX handler (previously sent standalone; this v2
includes it in the series after an automated review pass flagged the
same pattern in five other handlers).

Patch 2/2 applies the identical fix to amd_get_registers(),
atom_get_registers(), bdw_get_registers(), hda_dsp_get_registers()
and mtk_adsp_get_registers().

Ștefan Ghețu (2):
  ASoC: SOF: imx: Prevent stack OOB read in DSP panic dump
  ASoC: SOF: Prevent stack OOB read in the remaining DSP panic dumps

 sound/soc/sof/amd/acp-common.c           | 1 +
 sound/soc/sof/imx/imx-common.c           | 1 +
 sound/soc/sof/intel/atom.c               | 1 +
 sound/soc/sof/intel/bdw.c                | 1 +
 sound/soc/sof/intel/hda-dsp.c            | 1 +
 sound/soc/sof/mediatek/mtk-adsp-common.c | 1 +
 6 files changed, 6 insertions(+)

-- 
2.53.0