[PATCH v5 23/28] ASoC: SOF: Check that the audio buffer fits into the page table

[Peter Ujfalusi <peter.ujfalusi@linux.intel.com>]

The page table describing the audio buffer for the firmware is a single
PAGE_SIZE allocation, but snd_sof_create_page_table() writes the
compressed PFNs into it without checking that they fit.

The PFNs are stored in 2.5 bytes each and the last one is written with a
32 bit access, so with 4K pages the table can hold 1638 PFNs, which is a
buffer of 6.4MB. A larger buffer corrupts memory past the end of the
page table.

The PCM path is not affected as the maximum buffer size is specified by
the topology, but the compressed streams can ask for larger buffers.

Pass the page table buffer to snd_sof_create_page_table() instead of only
its address and verify that the buffer can be described by it.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
---
 sound/soc/sof/ipc3-dtrace.c |  2 +-
 sound/soc/sof/pcm.c         |  2 +-
 sound/soc/sof/sof-audio.c   |  2 +-
 sound/soc/sof/sof-utils.c   | 12 ++++++++++--
 sound/soc/sof/sof-utils.h   | 11 ++++++++++-
 5 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/sound/soc/sof/ipc3-dtrace.c b/sound/soc/sof/ipc3-dtrace.c
index 22053357731a..e8c998c09dc3 100644
--- a/sound/soc/sof/ipc3-dtrace.c
+++ b/sound/soc/sof/ipc3-dtrace.c
@@ -534,7 +534,7 @@ static int ipc3_dtrace_init(struct snd_sof_dev *sdev)
 
 	/* create compressed page table for audio firmware */
 	ret = snd_sof_create_page_table(sdev->dev, &priv->dmatb,
-					priv->dmatp.area, priv->dmatb.bytes);
+					&priv->dmatp, priv->dmatb.bytes);
 	if (ret < 0)
 		goto table_err;
 
diff --git a/sound/soc/sof/pcm.c b/sound/soc/sof/pcm.c
index 42738f12fa33..b4305dc43d61 100644
--- a/sound/soc/sof/pcm.c
+++ b/sound/soc/sof/pcm.c
@@ -194,7 +194,7 @@ static int sof_pcm_hw_params(struct snd_soc_component *component,
 		struct snd_dma_buffer *dmab = snd_pcm_get_dma_buf(substream);
 
 		ret = snd_sof_create_page_table(component->dev, dmab,
-				spcm->stream[substream->stream].page_table.area,
+				&spcm->stream[substream->stream].page_table,
 				runtime->dma_bytes);
 		if (ret < 0)
 			return ret;
diff --git a/sound/soc/sof/sof-audio.c b/sound/soc/sof/sof-audio.c
index 9f9f18b3c935..8cbeca471542 100644
--- a/sound/soc/sof/sof-audio.c
+++ b/sound/soc/sof/sof-audio.c
@@ -1132,6 +1132,6 @@ int snd_sof_compr_create_page_table(struct snd_soc_component *component,
 		return -EINVAL;
 
 	return snd_sof_create_page_table(component->dev, dmab,
-					 spcm->stream[dir].page_table.area, size);
+					 &spcm->stream[dir].page_table, size);
 }
 #endif
diff --git a/sound/soc/sof/sof-utils.c b/sound/soc/sof/sof-utils.c
index f70089317b8c..59dc10196958 100644
--- a/sound/soc/sof/sof-utils.c
+++ b/sound/soc/sof/sof-utils.c
@@ -24,12 +24,20 @@
 
 int snd_sof_create_page_table(struct device *dev,
 			      struct snd_dma_buffer *dmab,
-			      unsigned char *page_table, size_t size)
+			      struct snd_dma_buffer *page_table, size_t size)
 {
 	int i, pages;
 
 	pages = snd_sgbuf_aligned_pages(size);
 
+	if (pages < 1 || page_table->bytes < sizeof(u32) ||
+	    pages > SOF_PAGE_TABLE_MAX_PFNS(page_table->bytes)) {
+		dev_err(dev,
+			"Can not store %d pages in a %zu bytes page table\n",
+			pages, page_table->bytes);
+		return -EINVAL;
+	}
+
 	dev_dbg(dev, "generating page table for %p size 0x%zx pages %d\n",
 		dmab->area, size, pages);
 
@@ -45,7 +53,7 @@ int snd_sof_create_page_table(struct device *dev,
 		u32 pfn = snd_sgbuf_get_addr(dmab, i * PAGE_SIZE) >> PAGE_SHIFT;
 		u8 *pg_table;
 
-		pg_table = (u8 *)(page_table + idx);
+		pg_table = (u8 *)(page_table->area + idx);
 
 		/*
 		 * pagetable compression:
diff --git a/sound/soc/sof/sof-utils.h b/sound/soc/sof/sof-utils.h
index 9ac6de9a6d6a..58e5822a63f0 100644
--- a/sound/soc/sof/sof-utils.h
+++ b/sound/soc/sof/sof-utils.h
@@ -12,8 +12,17 @@
 struct snd_dma_buffer;
 struct device;
 
+/*
+ * Number of PFNs which can be stored in a page table of @bytes size.
+ * The PFNs are compressed to 2.5 bytes each but they are written with 32 bit
+ * accesses, therefore the last PFN can reach up to 3 bytes past the space it
+ * needs for itself.
+ */
+#define SOF_PAGE_TABLE_MAX_PFNS(bytes)	\
+	(((((bytes) - sizeof(u32)) << 1) + 1) / 5 + 1)
+
 int snd_sof_create_page_table(struct device *dev,
 			      struct snd_dma_buffer *dmab,
-			      unsigned char *page_table, size_t size);
+			      struct snd_dma_buffer *page_table, size_t size);
 
 #endif
-- 
2.56.0