Re: [PATCH] staging: greybus: audio: bound topology parsing to the received buffer

[Greg Kroah-Hartman]

On Sat, Jul 11, 2026 at 02:23:12AM +0500, Muhammad Bilal wrote:
> The Greybus audio topology parser trusts length and count fields taken
> straight from the module's topology blob and never checks them against
> the size of the buffer it actually allocated, leading to out-of-bounds
> reads of the kernel heap.
> 
> gb_audio_gb_get_topology() reads a u16 size from the module, allocates a
> buffer of that size, fetches the topology into it, and then discards the
> size. gbaudio_tplg_parse_data() then walks that buffer using fields
> stored inside it:
> 
>   - gbaudio_tplg_process_header() computes the control, widget and route
>     block offsets by adding the wire-supplied __le32 size_dais,
>     size_controls and size_widgets onto the buffer base with no bound, so
>     a module that reports a small allocation size but large block sizes
>     moves those offsets far past the end of the buffer before they are
>     dereferenced.
> 
>   - gbaudio_tplg_process_kcontrols(), _process_widgets() and
>     _process_routes() iterate num_controls / num_widgets / num_routes
>     (also from the blob) and advance a pointer by a per-element size that
>     includes the __le16 names_length of an enumerated control, again with
>     no check that the element stays inside the buffer.
> 
>   - gb_generate_enum_strings() loops over an attacker-controlled __le32
>     items count and, for each, scans for a NUL terminator with no end
>     pointer, walking off the end of the buffer.
> 
> A malicious or malfunctioning module can therefore make the parser read
> past the allocation. The wild block offsets are most likely to hit an
> unmapped page and oops (denial of service); the byte-at-a-time enum scan
> walks from a still-valid pointer and can copy adjacent heap bytes into
> ALSA control name strings, which are readable by unprivileged local
> users, so an information leak cannot be ruled out.
> 
> Thread the allocated topology size from gb_audio_gb_get_topology()
> through to gbaudio_tplg_parse_data() and bound every walk against the end
> of the buffer: verify the block offsets are ordered and within the
> buffer (the "< previous" tests also catch a 32-bit unsigned wrap of the
> running offset), check each control, widget and route lies fully inside
> its block before use, and give gb_generate_enum_strings() an explicit
> end pointer plus an items-versus-names_length sanity check.
> 
> Fixes: 6339d2322c47 ("greybus: audio: Add topology parser for GB codec")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Muhammad Bilal <meatuni001@xxxxxxxxx>

How was this found, and tested?

thanks,

greg k-h