[PATCH 0/6] ASoC: SOF: ipc3/ipc4-control: harden kcontrol payload handling

[Peter Ujfalusi <peter.ujfalusi@linux.intel.com>]

Hi,

This series hardens SOF kcontrol data paths for both IPC3 and IPC4 by
fixing size-handling bugs in put/get/update flows and tightening bounds
checks around firmware/user-provided payload lengths.

The changes include:

Fix TOCTOU-style size misuse in IPC3/IPC4 bytes put paths by validating and
using the incoming payload size.
Add notification/update payload size validation before parsing control data.
Use overflow-checked arithmetic when computing expected IPC3 control sizes.
Ensure update/copy bounds are validated against actual allocation limits.
Fix IPC3 bytes_ext bounds checks to account for struct header offset, closing
a heap overflow/over-read issue from unprivileged userspace TLV access.
Overall, the series makes control payload processing robust against malformed or
inconsistent sizes and prevents out-of-bounds accesses.

Regards,
Peter
---
Peter Ujfalusi (6):
  ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
  ASoC: SOF: ipc4-control: Validate notification payload size
  ASoC: SOF: ipc3-control: Use overflow checks in control_update size
    calc
  ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
  ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
  ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

 sound/soc/sof/ipc3-control.c | 79 +++++++++++++++++++++++++++---------
 sound/soc/sof/ipc4-control.c | 34 ++++++++++++++--
 2 files changed, 90 insertions(+), 23 deletions(-)

-- 
2.54.0