Unverified Commit 1549a69b authored Jul 12, 2022 by Peter Ujfalusi Committed by Mark Brown Jul 12, 2022

ASoC: SOF: Intel: mtl: Do not process IPC reply before firmware boot

It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.

Reported-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220712122357.31282-4-peter.ujfalusi@linux.intel.com

Signed-off-by: Mark Brown <broonie@kernel.org>

parent 499cc881

sound/soc/sof/intel/mtl.c

+13 −7

Original line number	Diff line number	Diff line
		@@ -512,6 +512,7 @@ static irqreturn_t mtl_ipc_irq_thread(int irq, void *context)
		*/
		if (primary & SOF_IPC4_MSG_DIR_MASK) {
		/* Reply received */
		if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) {
		struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data;

		data->primary = primary;
		@@ -523,6 +524,11 @@ static irqreturn_t mtl_ipc_irq_thread(int irq, void *context)
		snd_sof_ipc_reply(sdev, data->primary);

		spin_unlock_irq(&sdev->ipc_lock);
		} else {
		dev_dbg_ratelimited(sdev->dev,
		"IPC reply before FW_READY: %#x\|%#x\n",
		primary, extension);
		}
		} else {
		/* Notification received */
		notification_data.primary = primary;