Unverified Commit acacd9ee authored by Peter Ujfalusi's avatar Peter Ujfalusi Committed by Mark Brown
Browse files

ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot 



It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.

The issue was reported with IPC4 firmware but the same condition is present
for IPC3.

Reported-by: default avatarKai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: default avatarPeter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: default avatarRanjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: default avatarPierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220712122357.31282-2-peter.ujfalusi@linux.intel.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 388fe2b8

sound/soc/sof/intel/cnl.c

+24 −13
Original line number Diff line number Diff line
@@ -60,6 +60,7 @@ irqreturn_t cnl_ipc4_irq_thread(int irq, void *context) 


		if (primary & SOF_IPC4_MSG_DIR_MASK) {

			/* Reply received */

			if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) {

				struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data;



				data->primary = primary;
@@ -71,6 +72,11 @@ irqreturn_t cnl_ipc4_irq_thread(int irq, void *context) 
				snd_sof_ipc_reply(sdev, data->primary);



				spin_unlock_irq(&sdev->ipc_lock);

			} else {

				dev_dbg_ratelimited(sdev->dev,

						    "IPC reply before FW_READY: %#x|%#x\n",

						    primary, extension);

			}

		} else {

			/* Notification received */

			notification_data.primary = primary;
@@ -124,6 +130,7 @@ irqreturn_t cnl_ipc_irq_thread(int irq, void *context) 
					CNL_DSP_REG_HIPCCTL,

					CNL_DSP_REG_HIPCCTL_DONE, 0);



		if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) {

			spin_lock_irq(&sdev->ipc_lock);



			/* handle immediate reply from DSP core */
@@ -133,6 +140,10 @@ irqreturn_t cnl_ipc_irq_thread(int irq, void *context) 
			cnl_ipc_dsp_done(sdev);



			spin_unlock_irq(&sdev->ipc_lock);

		} else {

			dev_dbg_ratelimited(sdev->dev, "IPC reply before FW_READY: %#x\n",

					    msg);

		}



		ipc_irq = true;

	}