From 55e4b6d0b048b770c02a7533765a949b2bc9603e Mon Sep 17 00:00:00 2001 From: Shrushti P K Date: Tue, 13 Oct 2026 12:46:24 +0530 Subject: [PATCH] ipc4: handler-user: bound data_off_size in vendor config get The userspace large-config get path reads data_off_size straight from the host message and, for a vendor config, hands it to the vendor reader which divides it by sizeof(struct sof_tl) and walks that many entries out of the hostbox. data_off_size is a 20-bit host field so it can claim far more than the 4 KiB hostbox, over-reading roughly 1 MiB past it. The sibling get path and the vendor set path both already reject a data_off_size larger than the mailbox; this one was missed. Add the same bound before the cache invalidate and the read. Signed-off-by: Shrushti P K --- src/ipc/ipc4/handler-user.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/ipc/ipc4/handler-user.c b/src/ipc/ipc4/handler-user.c index 8aee53d382b3..0d2f5d498274 100644 --- a/src/ipc/ipc4/handler-user.c +++ b/src/ipc/ipc4/handler-user.c @@ -1142,6 +1142,14 @@ __cold static int ipc4_process_large_config_get(struct ipc4_message_request *ipc /* check for vendor param first */ if (config->extension.r.large_param_id == VENDOR_CONFIG_PARAM) { + /* data_off_size is a 20-bit host-controlled field, so it can + * claim far more than the hostbox can physically hold. + */ + if (data_offset > MAILBOX_HOSTBOX_SIZE) { + ipc_cmd_err(&ipc_tr, "data_off_size %u exceeds mailbox bound", + data_offset); + return IPC4_INVALID_CONFIG_DATA_STRUCT; + } /* For now only vendor_config case uses payload from hostbox */ dcache_invalidate_region((__sparse_force void __sparse_cache *)MAILBOX_HOSTBOX_BASE, config->extension.r.data_off_size);