ASoC: SOF: ipc4-control: Validate notification payload size

Validate MODULE_NOTIFICATION payload length before reading
bytes/channel data in control update handling.

Fixes: 2a28b5240f2b ("ASoC: SOF: ipc4-control: Add support for generic bytes control")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260609083458.31193-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/sof/ipc4-control.c b/sound/soc/sof/ipc4-control.c
index aa31eed05730f21796ed42109569101c10a3ca33..8d86d32a16caead0becff5155cce99fb053167b7 100644 (file)
--- a/sound/soc/sof/ipc4-control.c
+++ b/sound/soc/sof/ipc4-control.c
@@ -875,6 +875,16 @@ static void sof_ipc4_control_update(struct snd_sof_dev *sdev, void *ipc_message)
                 */
                if (type == SND_SOC_TPLG_TYPE_BYTES) {
                        struct sof_abi_hdr *data = cdata->data;
+                       size_t source_size = struct_size(msg_data, data, msg_data->num_elems);
+
+                       if (source_size > ndata->event_data_size) {
+                               dev_warn(sdev->dev,
+                                        "%s: invalid bytes notification size for %s (%zu, %u)\n",
+                                        __func__, scontrol->name, source_size,
+                                        ndata->event_data_size);
+                               scontrol->comp_data_dirty = true;
+                               goto notify;
+                       }
 
                        if (msg_data->num_elems > scontrol->max_size - sizeof(*data)) {
                                dev_warn(sdev->dev,
@@ -887,6 +897,17 @@ static void sof_ipc4_control_update(struct snd_sof_dev *sdev, void *ipc_message)
                                scontrol->size = sizeof(*cdata) + sizeof(*data) + data->size;
                        }
                } else {
+                       size_t source_size = struct_size(msg_data, chanv, msg_data->num_elems);
+
+                       if (source_size > ndata->event_data_size) {
+                               dev_warn(sdev->dev,
+                                        "%s: invalid channel notification size for %s (%zu, %u)\n",
+                                        __func__, scontrol->name, source_size,
+                                        ndata->event_data_size);
+                               scontrol->comp_data_dirty = true;
+                               goto notify;
+                       }
+
                        for (i = 0; i < msg_data->num_elems; i++) {
                                u32 channel = msg_data->chanv[i].channel;
 
@@ -914,6 +935,8 @@ static void sof_ipc4_control_update(struct snd_sof_dev *sdev, void *ipc_message)
                scontrol->comp_data_dirty = true;
        }
 
+notify:
+
        /*
         * Look up the ALSA kcontrol of the scontrol to be able to send a
         * notification to user space