kernel/linux.git/sound/soc/sof, branch v6.1.186

ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

2026-08-23T12:18:22+00:00

[ Upstream commit fd46668d538993218eea19c6925c868ac0f2630c ] The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct sof_ipc_ctrl_data including its flexible array payload. However, the bounds checks in bytes_ext_put and _bytes_ext_get compared user data lengths against max_size directly, ignoring that cdata->data sits at an offset of sizeof(struct sof_ipc_ctrl_data) bytes into the allocation. This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data on the get path. Fix all bounds checks to subtract sizeof(*cdata) from max_size so they reflect the actual space available at the cdata->data offset. Also fix the error-path restore in bytes_ext_put which wrote to cdata->data instead of cdata, causing the same overflow. Fixes: 67ec2a091630 ("ASoC: SOF: Add bytes_ext control IPC ops for IPC3") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Reviewed-by: Liam Girdwood Reviewed-by: Bard Liao Link: https://patch.msgid.link/20260609083458.31193-7-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown [ replicated the single shared-helper bounds-check fix into the two standalone get functions and dropped the err_restore memcpy hunk absent in 6.1 ] Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

2026-07-24T13:54:59+00:00

commit 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e upstream. In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. Add a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation before copying. Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Reviewed-by: Liam Girdwood Reviewed-by: Bard Liao Link: https://patch.msgid.link/20260609083458.31193-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman

ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get

2026-07-24T13:54:58+00:00

commit 1f97760417b5faa60e9642fd0ed61eb17d0b1b39 upstream. In sof_ipc3_bytes_put(), the size used for the memcpy is derived from the old data->size already in the buffer, not the incoming new data's size field. If the new data has a different size, the copy length is wrong: it may truncate valid data or copy stale bytes. Similarly, sof_ipc3_bytes_get() checks data->size against max_size without accounting for the sizeof(struct sof_ipc_ctrl_data) offset of the flex array within the allocation. Fix bytes_put to validate and use the incoming data's sof_abi_hdr.size from ucontrol before copying. Fix bytes_get to subtract sizeof(*cdata) from the bounds check to match the actual available space. Fixes: 544ac8858f24 ("ASoC: SOF: Add bytes_get/put control IPC ops for IPC3") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Reviewed-by: Liam Girdwood Reviewed-by: Bard Liao Link: https://patch.msgid.link/20260609083458.31193-6-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman

ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc

2026-07-24T13:54:57+00:00

commit 8791977d7289f6e9d2b014f60a5455f053a7bc04 upstream. In sof_ipc3_control_update(), the expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms, wrapping to a small value. This would allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access in snd_sof_update_control. Use check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations. Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Reviewed-by: Liam Girdwood Reviewed-by: Bard Liao Link: https://patch.msgid.link/20260609083458.31193-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman

ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

2026-06-01T15:39:31+00:00

[ Upstream commit d8d99c3b5c485f339864aeaa29f76269cc0ea975 ] The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect and can lead to NULL pointer dereference. Fixes: 090349a9feba ("ASoC: SOF: Add support for compress API for stream data/offset") Cc: stable@vger.kernel.org Reported-by: Curtis Malainey Closes: https://github.com/thesofproject/linux/pull/5214 Signed-off-by: Peter Ujfalusi Reviewed-by: Daniel Baluta Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Curtis Malainey Link: https://patch.msgid.link/20250205135232.19762-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin

ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close

2026-06-01T15:39:31+00:00

[ Upstream commit 46c7b901e2a03536df5a3cb40b3b26e2be505df6 ] The spcm->stream[substream->stream].substream is set during open and was left untouched. After the first PCM stream it will never be NULL and we have code which checks for substream NULLity as indication if the stream is active or not. For the compressed cstream pointer the same has been done, this change will correct the handling of PCM streams. Fixes: 090349a9feba ("ASoC: SOF: Add support for compress API for stream data/offset") Cc: stable@vger.kernel.org Reported-by: Curtis Malainey Closes: https://github.com/thesofproject/linux/pull/5214 Signed-off-by: Peter Ujfalusi Reviewed-by: Daniel Baluta Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Curtis Malainey Link: https://patch.msgid.link/20250205135232.19762-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin

ASoC: SOF: compress: return the configured codec from get_params

2026-06-01T15:39:13+00:00

[ Upstream commit 2c4fdd055f92a2fc8602dcd88bcea08c374b7e8b ] The SOF compressed offload path accepts codec parameters in sof_compr_set_params() and forwards them to firmware as extended data in the SOF IPC stream params message. However, sof_compr_get_params() still returns success without filling the snd_codec structure. Since the compress core allocates that structure zeroed and copies it back to userspace on success, SNDRV_COMPRESS_GET_PARAMS returns an all-zero codec description even after the stream has been configured successfully. The stale TODO in this callback conflates get_params() with capability discovery. Supported codec enumeration belongs in get_caps() and get_codec_caps(). get_params() should report the current codec settings. Cache the codec accepted by sof_compr_set_params() in the per-stream SOF compress state and return it from sof_compr_get_params(). Fixes: 6324cf901e14 ("ASoC: SOF: compr: Add compress ops implementation") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260325-sof-compr-get-params-v1-1-0758815f13c7@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin

ASoC: SOF: Add support for compress API for stream data/offset

2026-06-01T15:39:13+00:00

[ Upstream commit 090349a9feba3ceee3997d31d68ffe54e5b57acb ] snd_sof_pcm_stream keeps information about both PCM (snd_pcm_substream) and Compress (snd_compr_stream) streams. When PCM substream pointer is NULL this means we are dealing with a compress stream. Reviewed-by: Paul Olaru Reviewed-by: Iuliana Prodan Reviewed-by: Ranjani Sridharan Reviewed-by: Peter Ujfalusi Signed-off-by: Daniel Baluta Link: https://lore.kernel.org/r/20230117122533.201708-4-daniel.baluta@oss.nxp.com Signed-off-by: Mark Brown Stable-dep-of: 2c4fdd055f92 ("ASoC: SOF: compress: return the configured codec from get_params") Signed-off-by: Sasha Levin

ASoC: SOF: Prepare set_stream_data_offset for compress API

2026-06-01T15:39:13+00:00

[ Upstream commit 249f186d6b0211fc59d83db128030f2b298063a1 ] Make second parameter of set_stream_data_offset generic in order to be used for both PCM and compress streams. Current patch doesn't introduce any functional change, just prepare the code for compress support. Reviewed-by: Paul Olaru Reviewed-by: Iuliana Prodan Reviewed-by: Ranjani Sridharan Reviewed-by: Peter Ujfalusi Signed-off-by: Daniel Baluta Link: https://lore.kernel.org/r/20230117122533.201708-3-daniel.baluta@oss.nxp.com Signed-off-by: Mark Brown Stable-dep-of: 2c4fdd055f92 ("ASoC: SOF: compress: return the configured codec from get_params") Signed-off-by: Sasha Levin

ASoC: SOF: Prepare ipc_msg_data to be used with compress API

2026-06-01T15:39:13+00:00

[ Upstream commit 1b905942d6cd182b7ef14e9f095178376d3847e6 ] Make second parameter of ipc_msg_data generic in order to be able to support compressed streams. This patch doesn't hold any functional change. With this case we can use ipc_msg_data, to retrieve information from DSP for both PCM/Compress API. Reviewed-by: Paul Olaru Reviewed-by: Iuliana Prodan Reviewed-by: Ranjani Sridharan Reviewed-by: Peter Ujfalusi Signed-off-by: Daniel Baluta Link: https://lore.kernel.org/r/20230117122533.201708-2-daniel.baluta@oss.nxp.com Signed-off-by: Mark Brown Stable-dep-of: 2c4fdd055f92 ("ASoC: SOF: compress: return the configured codec from get_params") Signed-off-by: Sasha Levin