Re: [PATCH] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check

[Takashi Iwai]

On Wed, 14 Oct 2026 12:26:18 +0200,
Denis Arefev wrote:
> 
> ins->code.offset and code->size are measured in 32-bit words, while
> DSP_CODE_BYTE_SIZE is the size of the DSP code area in bytes. The
> check ins->code.offset + code->size > DSP_CODE_BYTE_SIZE in
> cs46xx_dsp_load_module() therefore allowed up to four times more code
> than the code area can hold.
> 
> The shadow buffer ins->code.data is allocated with
> kmalloc(DSP_CODE_BYTE_SIZE), i.e. it holds DSP_CODE_BYTE_SIZE/4
> words. A firmware file with a code segment larger than
> DSP_CODE_BYTE_SIZE/4 words (28 KiB) passed the check and caused an
> out-of-bounds write in shadow_and_reallocate_code() and an
> out-of-bounds read in snd_cs46xx_download().
> 
> Compare the sum in words against DSP_CODE_BYTE_SIZE/4 and cast it to
> u64 so that the sum cannot wrap for large code->size values.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Denis Arefev <arefev@xxxxxxxxx>

Applied to for-next branch.  Thanks.


Takashi