Repository navigation
audio: mux: cap IPC3 mux routes at the lookup table size - #11354
Open
Shrusti-pk wants to merge 1 commit into
Open
Shrusti-pk wants to merge 1 commit into
Shrusti-pk wants to merge 1 commit into
Conversation
mux_prepare_look_up_table() puts every set mask bit of every stream into the single lookup[0] table, and mux_prepare_active_look_up() copies the routes that match the connected channels into active_lookup. Both tables hold PLATFORM_MAX_CHANNELS entries and neither loop is bounded. mux_set_values() limits each mask to one bit, and mux_mix_check() rejects a stream that reuses an output bit or two streams that set the same bit at the same mask index. A blob where two streams route different input channels to the same output passes both checks, so num_streams = 2 with mask[j] = BIT(j) and BIT((j + 1) % 8) gives 16 routes, and num_streams = 4 gives 32. With 8 channel sources and sink, mux_prepare_active_look_up() then writes past active_lookup over model_handler, comp_type and config, and past the end of the component data allocation. Reject a mux configuration with more than PLATFORM_MAX_CHANNELS routes in total. Demux is unaffected, as each stream has its own table bounded by the one bit per mask check.
Collaborator
|
Can one of the admins verify this patch?
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The IPC3 mux builds its routing from the bytes control blob: mux_prepare_look_up_table() turns every set mask bit of every stream into an entry of lookup[0], and mux_prepare_active_look_up() copies the routes that match the connected channels into active_lookup, both sized for PLATFORM_MAX_CHANNELS entries with no bound on either loop. mux_set_values() only limits each mask to one bit, and mux_mix_check() only rejects a stream reusing an output bit or two streams setting the same bit at the same mask index. Two streams routing different input channels to the same output pass both checks, so num_streams = 2 with mask[j] = BIT(j) and BIT((j + 1) % 8) yields 16 routes, and four streams yield 32. With 8 channel sources and sink every route survives the active filter, and the copy runs over model_handler, comp_type and config and then past the end of the component data allocation. I confirmed it with an ASan harness built from the same validation and lookup code, which reports a heap-buffer-overflow WRITE in mux_prepare_active_look_up() right after the comp_data region. The check sits in mux_set_values() next to the existing mask checks, so a blob with more routes than the table holds is rejected before any table is built; demux keeps per-stream tables already bounded by the one bit per mask rule, and the mux_copy test masks all stay within 8 routes.