Re: [PATCH] ASoC: Intel: avs: validate configuration TLV bounds

[Cezary Rojewski]

On 7/15/2026 10:33 AM, Pengpeng Hou wrote:
> Firmware and hardware configuration replies are parsed as a sequence of
> TLVs. The walkers only check that the complete reply is non-empty before
> casting the current offset to struct avs_tlv, reading its header, and
> consuming type-specific values. A short header or a declared value that
> extends past the reply can therefore be consumed as part of the current
> item.
>
> Validate the fixed TLV header and the declared value span before dispatch.
> Also require the value space used by the selected type: firmware version
> copies need the complete version structure, scalar configuration values
> need one u32, and I2S capabilities need their two-word prefix plus all
> declared controller addresses.

Hello Pengpeng,

I understand where are you coming from but there is no reason for such 
defense - as per Intel audio driver architecture, firmware is the root 
of trust.  If one breaches the verification mechanism, the TLVs are the 
least of our problems.

At the same time, struct avs_tlv is no different from any TLV in the 
kernel so I'd rather see the functions you're adding here applied to the 
kernel/ or drivers/base or other common location, not hidden within 
sound/soc/intel/avs/.

TLDR: NAK

Kind regards,
Czarek