[PATCH] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check

[PATCH] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check

[Denis Arefev]

ins->code.offset and code->size are measured in 32-bit words, while
DSP_CODE_BYTE_SIZE is the size of the DSP code area in bytes. The
check ins->code.offset + code->size > DSP_CODE_BYTE_SIZE in
cs46xx_dsp_load_module() therefore allowed up to four times more code
than the code area can hold.

The shadow buffer ins->code.data is allocated with
kmalloc(DSP_CODE_BYTE_SIZE), i.e. it holds DSP_CODE_BYTE_SIZE/4
words. A firmware file with a code segment larger than
DSP_CODE_BYTE_SIZE/4 words (28 KiB) passed the check and caused an
out-of-bounds write in shadow_and_reallocate_code() and an
out-of-bounds read in snd_cs46xx_download().

Compare the sum in words against DSP_CODE_BYTE_SIZE/4 and cast it to
u64 so that the sum cannot wrap for large code->size values.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
 Compile tested only
 sound/pci/cs46xx/dsp_spos.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
index 6fd4f629d1d5..a77e6f5a14ad 100644
--- a/sound/pci/cs46xx/dsp_spos.c
+++ b/sound/pci/cs46xx/dsp_spos.c
@@ -393,7 +393,7 @@ int cs46xx_dsp_load_module (struct snd_cs46xx * chip, struct dsp_module_desc * m
 		dev_dbg(chip->card->dev,
 			"dsp_spos: module got no code segment\n");
 	} else {
-		if (ins->code.offset + code->size > DSP_CODE_BYTE_SIZE) {
+		if ((u64)ins->code.offset + code->size > DSP_CODE_BYTE_SIZE / 4) {
 			dev_err(chip->card->dev,
 				"dsp_spos: no space available in DSP\n");
 			return -ENOMEM;
-- 
2.43.0

Re: [PATCH] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check

[Takashi Iwai]

On Wed, 14 Oct 2026 12:26:18 +0200,
Denis Arefev wrote:
> 
> ins->code.offset and code->size are measured in 32-bit words, while
> DSP_CODE_BYTE_SIZE is the size of the DSP code area in bytes. The
> check ins->code.offset + code->size > DSP_CODE_BYTE_SIZE in
> cs46xx_dsp_load_module() therefore allowed up to four times more code
> than the code area can hold.
> 
> The shadow buffer ins->code.data is allocated with
> kmalloc(DSP_CODE_BYTE_SIZE), i.e. it holds DSP_CODE_BYTE_SIZE/4
> words. A firmware file with a code segment larger than
> DSP_CODE_BYTE_SIZE/4 words (28 KiB) passed the check and caused an
> out-of-bounds write in shadow_and_reallocate_code() and an
> out-of-bounds read in snd_cs46xx_download().
> 
> Compare the sum in words against DSP_CODE_BYTE_SIZE/4 and cast it to
> u64 so that the sum cannot wrap for large code->size values.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Denis Arefev <arefev@swemel.ru>

Applied to for-next branch.  Thanks.


Takashi