ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
authorPeter Ujfalusi <peter.ujfalusi@linux.intel.com>
Tue, 12 Jul 2022 12:23:56 +0000 (15:23 +0300)
committerMark Brown <broonie@kernel.org>
Tue, 12 Jul 2022 12:45:02 +0000 (13:45 +0100)
commit499cc881b09c8283ab5e75b0d6d21cb427722161
treefc045af0537c792fc8fafb7c7dfa1508c5e138b7
parentacacd9eefd0def5a83244d88e5483b5f38ee7287
ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot

It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.

The issue was reported with IPC4 firmware but the same condition is present
for IPC3.

Reported-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220712122357.31282-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
sound/soc/sof/intel/hda-ipc.c