[PATCH v2] ASoC: SOF: validate topology volume range before allocation

[PATCH v2] ASoC: SOF: validate topology volume range before allocation

[Pengpeng Hou]

SOF treats the topology mixer min and max values as non-negative indices
into its volume table. It stores them in signed fields, allocates max + 1
entries through an int argument, and later indexes the table with the
stored range.

An inverted range is invalid, while a maximum at or above INT_MAX cannot
be represented safely after the increment or in the signed fields.
Validate the complete range before storing it or allocating the table.

Fixes: 311ce4fe7637 ("ASoC: SOF: Add support for loading topologies")
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes since v1: https://lore.kernel.org/all/20260722041532.14085-1-pengpeng@iscas.ac.cn/
- validate SOF's non-negative table-index range before signed storage
- require max + 1 to remain representable by the allocator's int argument
- rebase on current SOF topology sources

The SOF table-index consumers and allocator conversion were reviewed
statically; no SOF topology or hardware test was performed.

 sound/soc/sof/topology.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
index 42a2d90bb705..31dd7a66a9cf 100644
--- a/sound/soc/sof/topology.c
+++ b/sound/soc/sof/topology.c
@@ -846,6 +846,7 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
 	struct snd_soc_tplg_mixer_control *mc =
 		container_of(hdr, struct snd_soc_tplg_mixer_control, hdr);
 	int tlv[SOF_TLV_ITEMS];
+	u32 min, max;
 	unsigned int mask;
 	int ret;
 
@@ -853,6 +854,11 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
 	if (le32_to_cpu(mc->num_channels) > SND_SOC_TPLG_MAX_CHAN)
 		return -EINVAL;
 
+	min = le32_to_cpu(mc->min);
+	max = le32_to_cpu(mc->max);
+	if (min > max || max >= INT_MAX)
+		return -EINVAL;
+
 	/*
 	 * If control has more than 2 channels we need to override the info. This is because even if
 	 * ASoC layer has defined topology's max channel count to SND_SOC_TPLG_MAX_CHAN = 8, the
@@ -863,12 +869,12 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
 		kc->info = snd_sof_volume_info;
 
 	scontrol->comp_id = sdev->next_comp_id;
-	scontrol->min_volume_step = le32_to_cpu(mc->min);
-	scontrol->max_volume_step = le32_to_cpu(mc->max);
+	scontrol->min_volume_step = min;
+	scontrol->max_volume_step = max;
 	scontrol->num_channels = le32_to_cpu(mc->num_channels);
 
-	scontrol->max = le32_to_cpu(mc->max);
-	if (le32_to_cpu(mc->max) == 1)
+	scontrol->max = max;
+	if (max == 1)
 		goto skip;
 
 	/* extract tlv data */
@@ -878,7 +884,7 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
 	}
 
 	/* set up volume table */
-	ret = set_up_volume_table(scontrol, tlv, le32_to_cpu(mc->max) + 1);
+	ret = set_up_volume_table(scontrol, tlv, max + 1);
 	if (ret < 0) {
 		dev_err(scomp->dev, "error: setting up volume table\n");
 		return ret;
@@ -911,7 +917,7 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
 	return 0;
 
 err:
-	if (le32_to_cpu(mc->max) > 1)
+	if (max > 1)
 		kfree(scontrol->volume_table);
 
 	return ret;
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v2] ASoC: SOF: validate topology volume range before allocation

[Péter Ujfalusi]

On 14/08/2026 11:12, Pengpeng Hou wrote:
> SOF treats the topology mixer min and max values as non-negative indices
> into its volume table. It stores them in signed fields, allocates max + 1
> entries through an int argument, and later indexes the table with the
> stored range.
> 
> An inverted range is invalid, while a maximum at or above INT_MAX cannot
> be represented safely after the increment or in the signed fields.
> Validate the complete range before storing it or allocating the table.
> 
> Fixes: 311ce4fe7637 ("ASoC: SOF: Add support for loading topologies")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> Changes since v1: https://lore.kernel.org/all/20260722041532.14085-1-pengpeng@iscas.ac.cn/
> - validate SOF's non-negative table-index range before signed storage
> - require max + 1 to remain representable by the allocator's int argument
> - rebase on current SOF topology sources

The patch appears to be identical to v1 to my non agent eyes ;)

Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>

> 
> The SOF table-index consumers and allocator conversion were reviewed
> statically; no SOF topology or hardware test was performed.
> 
>  sound/soc/sof/topology.c | 18 ++++++++++++------
>  1 file changed, 12 insertions(+), 6 deletions(-)
> 
> diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
> index 42a2d90bb705..31dd7a66a9cf 100644
> --- a/sound/soc/sof/topology.c
> +++ b/sound/soc/sof/topology.c
> @@ -846,6 +846,7 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
>  	struct snd_soc_tplg_mixer_control *mc =
>  		container_of(hdr, struct snd_soc_tplg_mixer_control, hdr);
>  	int tlv[SOF_TLV_ITEMS];
> +	u32 min, max;
>  	unsigned int mask;
>  	int ret;
>  
> @@ -853,6 +854,11 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
>  	if (le32_to_cpu(mc->num_channels) > SND_SOC_TPLG_MAX_CHAN)
>  		return -EINVAL;
>  
> +	min = le32_to_cpu(mc->min);
> +	max = le32_to_cpu(mc->max);
> +	if (min > max || max >= INT_MAX)
> +		return -EINVAL;
> +
>  	/*
>  	 * If control has more than 2 channels we need to override the info. This is because even if
>  	 * ASoC layer has defined topology's max channel count to SND_SOC_TPLG_MAX_CHAN = 8, the
> @@ -863,12 +869,12 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
>  		kc->info = snd_sof_volume_info;
>  
>  	scontrol->comp_id = sdev->next_comp_id;
> -	scontrol->min_volume_step = le32_to_cpu(mc->min);
> -	scontrol->max_volume_step = le32_to_cpu(mc->max);
> +	scontrol->min_volume_step = min;
> +	scontrol->max_volume_step = max;
>  	scontrol->num_channels = le32_to_cpu(mc->num_channels);
>  
> -	scontrol->max = le32_to_cpu(mc->max);
> -	if (le32_to_cpu(mc->max) == 1)
> +	scontrol->max = max;
> +	if (max == 1)
>  		goto skip;
>  
>  	/* extract tlv data */
> @@ -878,7 +884,7 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
>  	}
>  
>  	/* set up volume table */
> -	ret = set_up_volume_table(scontrol, tlv, le32_to_cpu(mc->max) + 1);
> +	ret = set_up_volume_table(scontrol, tlv, max + 1);
>  	if (ret < 0) {
>  		dev_err(scomp->dev, "error: setting up volume table\n");
>  		return ret;
> @@ -911,7 +917,7 @@ static int sof_control_load_volume(struct snd_soc_component *scomp,
>  	return 0;
>  
>  err:
> -	if (le32_to_cpu(mc->max) > 1)
> +	if (max > 1)
>  		kfree(scontrol->volume_table);
>  
>  	return ret;

-- 
Péter

Re: [PATCH v2] ASoC: SOF: validate topology volume range before allocation

[Mark Brown]

On Fri, 14 Aug 2026 16:12:38 +0800, Pengpeng Hou wrote:
> ASoC: SOF: validate topology volume range before allocation

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-7.3

Thanks!

[1/1] ASoC: SOF: validate topology volume range before allocation
      https://git.kernel.org/broonie/sound/c/a698e4a60fa5

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark