ASoC: SOF: Check that the audio buffer fits into the page table

The page table describing the audio buffer for the firmware is a single
PAGE_SIZE allocation, but snd_sof_create_page_table() writes the
compressed PFNs into it without checking that they fit.

The PFNs are stored in 2.5 bytes each and the last one is written with a
32 bit access, so with 4K pages the table can hold 1638 PFNs, which is a
buffer of 6.4MB. A larger buffer corrupts memory past the end of the
page table.

The PCM path is not affected as the maximum buffer size is specified by
the topology, but the compressed streams can ask for larger buffers.

Pass the page table buffer to snd_sof_create_page_table() instead of only
its address and verify that the buffer can be described by it.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261007084955.1256-24-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>

0 files changed, 0 insertions, 0 deletions