base_fw: reject undersized system time payload#10929
Conversation
The system-time handler dereferenced the payload as a fixed struct without checking the supplied size, reading past the mailbox for a short payload. Reject a payload smaller than the struct. Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
lgirdwood
requested review from
dbaluta,
kv2019i,
lbetlej,
mmaka1 and
plbossart
as code owners
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR hardens the SYSTEM_TIME large-config handler against undersized payloads by validating the incoming payload size before dereferencing it as struct ipc4_system_time, preventing out-of-bounds reads.
Changes:
- Add a minimum-size check for
struct ipc4_system_timebefore reading mailbox payload data. - Return an error for undersized SYSTEM_TIME payloads to avoid invalid memory access.
| if (data_offset < sizeof(struct ipc4_system_time)) | ||
| return IPC4_ERROR_INVALID_PARAM; |
There was a problem hiding this comment.
data_offset here is the payload size, not an offset — lyakh confirmed the same in the review. The large-config set path passes the fragment/payload length in this argument (the parameter name is misleading and worth renaming separately), so checking it against sizeof(struct ipc4_system_time) is correct.
lyakh
left a comment
lyakh
left a comment
There was a problem hiding this comment.
I think data_offset does actually mean "size," so this is correct... We should really rename that parameter at least in functions, where it definitely means size
The SYSTEM_TIME large-config handler dereferenced the payload as a fixed
struct without checking the supplied size, reading past the mailbox for a
short payload. Reject a payload smaller than
struct ipc4_system_time.No functional change for valid configurations.