Repository navigation
audio: dax: check param header fits before reading it - #11342
Open
Shrusti-pk wants to merge 1 commit into
Open
Shrusti-pk wants to merge 1 commit into
Shrusti-pk wants to merge 1 commit into
Conversation
update_params_from_buffer() walks the DAX tuning blob as a sequence of struct module_param records but reads param->id and param->size before checking that a whole 8-byte header is left in the buffer. The blob comes from the host via IPC4_DAX_MODULE_CFG_PARAM_BLOB (or the IPC3 binary control) and comp_data_blob_set() stores it in a heap buffer of exactly the received size. A blob that leaves 1 to 7 bytes after its last complete record, or is shorter than one header, makes the loop read up to 7 bytes past the end of that allocation. The nested DAX_PARAM_ID_ENDPOINT walk goes through the same loop. Reject a truncated header at the top of the loop, as the module_param walkers in waves.c, dts.c and cadence.c already do.
Shrusti-pk
requested review from
dbaluta,
kv2019i,
lbetlej,
lgirdwood,
mmaka1 and
plbossart
as code owners
October 23, 2026 07:49
Collaborator
|
Can one of the admins verify this patch?
|
PR 11342: test resultsRun date: 2026-10-23 09:13 UTC Tested commit: 4115737f1c20828c669b6813f6cbf6a3604866e1
|
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The narrow bounds check safely rejects truncated headers before access without changing valid-record processing.
No open issues 🎉
What changed in this PR
This PR hardens the DAX tuning-blob parser against out-of-bounds reads from truncated parameter headers.
Changes:
- Checks that a complete header remains before accessing parameter fields.
- Returns
-EINVALfor truncated headers while preserving valid-record parsing.
| File | Description |
|---|---|
src/audio/module_adapter/module/dolby/dax.c |
Adds a remaining-length guard before reading each parameter header. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
update_params_from_buffer() in the DAX module reads each module_param header before checking that 8 bytes are left in the tuning blob:
The waves.c, dts.c and cadence.c module_param walkers already reject a truncated header this way. Blobs made of whole records parse as before.