[PATCH 0/2] ASoC: qcom: qdsp6: bound the compress ring by the DMA buffer

[Julius Bairaktaris]

q6apm-dai and q6asm-dai allocate a fixed 8 MiB DMA buffer when a
compress stream opens and take the ring geometry from
SNDRV_COMPRESS_SET_PARAMS without comparing it to that buffer. Their
copy callbacks place each write() at the stream position modulo the
ring size, so a user who can open the compress node and asks for a
larger ring makes write() copy data of their choice past the buffer.
Each patch rejects such a ring in set_params.

I used Claude (Anthropic) to help write these patches.

Julius Bairaktaris (2):
  ASoC: qcom: q6apm-dai: reject compress rings larger than the DMA
    buffer
  ASoC: qcom: q6asm-dai: reject compress rings larger than the DMA
    buffer

 sound/soc/qcom/qdsp6/q6apm-dai.c | 3 +++
 sound/soc/qcom/qdsp6/q6asm-dai.c | 3 +++
 2 files changed, 6 insertions(+)


base-commit: 20f1752b9241d300b42cd45a07e22d063bccba45
-- 
2.53.0