Re: [PATCH 1/2] ASoC: qcom: q6apm-dai: reject compress rings larger than the DMA buffer

[Srinivas Kandagatla]

On 11/11/26 8:06 AM, Julius Bairaktaris wrote:
> q6apm_dai_compr_open() allocates a fixed 8 MiB DMA buffer, but
> q6apm_dai_compr_set_params() takes the ring size from the fragment size
> and count that userspace passes to SNDRV_COMPRESS_SET_PARAMS without
> checking it against that buffer. The compress core checks the geometry
> against the runtime buffer only for drivers without a copy callback.
> q6apm_compr_copy() places each write() at the stream position modulo the
> ring size, so a ring larger than the DMA buffer lets write() copy user
> data past its end, and after SNDRV_COMPRESS_NEXT_TRACK the copy starts at
> the next multiple of the fragment size.
> 
> Reject a ring larger than the DMA buffer.
> 
> Fixes: c317d148a2b0 ("ASoC: q6dsp: q6apm-dai: Add mmap and copy compress DAI callbacks")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Julius Bairaktaris <julius@xxxxxxxxxxxxxx>
> ---

Thanks for sending the patches

both look good to me, but I would recommend adding a dev_err() so that
its visible to user if it fails.

once that is fixed.

Reviewed-by: Srinivas Kandagatla<srinivas.kandagatla@xxxxxxxxxxxxxxxx>

--Srini

>  sound/soc/qcom/qdsp6/q6apm-dai.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c
> index 58beaf906b9ff..80b837992b429 100644
> --- a/sound/soc/qcom/qdsp6/q6apm-dai.c
> +++ b/sound/soc/qcom/qdsp6/q6apm-dai.c
> @@ -990,6 +990,9 @@ static int q6apm_dai_compr_set_params(struct snd_soc_component *component,
>  	if (!pdata)
>  		return -EINVAL;
>  
> +	if (runtime->buffer_size > prtd->dma_buffer.bytes)
> +		return -EINVAL;
> +
>  	prtd->periods = runtime->fragments;
>  	prtd->pcm_count = runtime->fragment_size;
>  	prtd->pcm_size = runtime->fragments * runtime->fragment_size;