Conversation
tmleman
requested review from
dbaluta,
kv2019i,
lbetlej,
lgirdwood,
mmaka1 and
plbossart
as code owners
October 5, 2026 09:08
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The new deallocator call omits its required handler argument and will not compile.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Prevents malformed IPC3 blob fragments from panicking firmware by handling copy failures gracefully.
Changes:
- Frees and resets partial blob state when
memcpy_s()fails. - Returns the copy error to the IPC caller.
| File | Description |
|---|---|
src/audio/data_blob.c |
Adds graceful oversized-fragment error handling. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
tmleman
force-pushed
the
topic/upstream/pr/ipc3/audio/data_blob/fail_gracefully
branch
from
October 5, 2026 09:13
ef897c0 to
b67f66b
Compare
comp_data_blob_set_cmd() reassembles a host-provided blob from multiple SOF_IPC_COMP_SET_DATA fragments. cdata->num_elems and cdata->data->size are host-controlled. When a fragment's num_elems exceeds the remaining capacity (new_data_size - data_pos), memcpy_s() correctly refuses the copy and returns non-zero, but the following assert(!ret) then panics the DSP. A single malformed host SET request (small declared size, larger num_elems) is therefore enough to crash the firmware. Replace the assert with a graceful error path that frees and resets the in-progress blob state and returns the error to the IPC caller, mirroring the earlier IPC4 fix in ipc4_comp_data_blob_set() (commit 93be3b1). The destination size passed to memcpy_s() was already correct, so no bound is changed and legitimate transfers are unaffected. Found by libFuzzer IPC3/UBSan; all six reproducers now return cleanly and the ipc3 corpus (44828 runs) shows no regression. Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>
PR 11267: test resultsRun date: 2026-10-05 10:59 UTC Tested commit: b67f66b09ca7ef793590948934071a5f21513007
|
tmleman
requested review from
abonislawski,
serhiy-katsyuba-intel,
softwarecki and
wjablon1
October 5, 2026 16:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
comp_data_blob_set_cmd() reassembles a host-provided blob from multiple SOF_IPC_COMP_SET_DATA fragments. cdata->num_elems and cdata->data->size are host-controlled. When a fragment's num_elems exceeds the remaining capacity (new_data_size - data_pos), memcpy_s() correctly refuses the copy and returns non-zero, but the following assert(!ret) then panics the DSP. A single malformed host SET request (small declared size, larger num_elems) is therefore enough to crash the firmware.
Replace the assert with a graceful error path that frees and resets the in-progress blob state and returns the error to the IPC caller, mirroring the earlier IPC4 fix in ipc4_comp_data_blob_set() (commit 93be3b1). The destination size passed to memcpy_s() was already correct, so no bound is changed and legitimate transfers are unaffected.
Found by libFuzzer IPC3/UBSan; all six reproducers now return cleanly and the ipc3 corpus (44828 runs) shows no regression.