Skip to content

audio: up_down_mixer: validate host output channel map - #11392

Open
Shrusti-pk wants to merge 1 commit into
thesofproject:mainfrom
Shrusti-pk:up-down-mixer-out-map-bound
Open

Shrusti-pk wants to merge 1 commit into
thesofproject:mainfrom
Shrusti-pk:up-down-mixer-out-map-bound

Conversation

@Shrusti-pk

Copy link
Copy Markdown
Contributor

The up_down_mixer writes through a host supplied channel map without checking where it points:

  • channel_map is taken straight from the IPC4 init payload when coefficients_select is one of the *_WITH_CHANNEL_MAP values, and the 5.1 and 7.1 routines place each output channel at get_channel_location() * 4 bytes into the frame with no further check
  • a channel missing from the map resolves to CHANNEL_INVALID (0xF), and a channel placed in nibble 6 or 7 of a 5.1 map lands past the six channel frame, so the last frame is written past the end of the sink buffer (ASan on the real upmix32bit_1_to_5_1(): heap-buffer-overflow WRITE 12 bytes past a 96 byte sink with map 0xFFF43210, 4 bytes past it with 0x7FF43210)
  • the module is on by default for every Intel ADSP board

Rejected such maps in init_mix(); the default maps from create_channel_map() and the 5.1 surround variant with the side pair still pass. The two mono to 5.1 routines gain the side pair fallback their siblings already have, and the quatro routine now reads the side pair from the output map, so the init check matches what every 5.1 routine writes.

up_down_mixer_init() takes the channel_map word of the IPC4 init
payload as is when coefficients_select is one of the
*_WITH_CHANNEL_MAP values. The 5.1 and 7.1 output routines then place
each output channel at get_channel_location(map, channel) * 4 bytes
into the frame and write there for every frame without any further
check. A channel the map does not name resolves to CHANNEL_INVALID
(0xF) and a channel placed in nibble 6 or 7 of a 5.1 map resolves to a
slot past the six channel frame, so the last frame is written past the
end of the sink buffer.

Add out_channel_map_valid() and call it from init_mix(). A 5.1 map must
place left, center, right, LFE and either the surround pair or, when
both surround channels are absent, the side pair at slots below 6. A
7.1 map must name all eight channels. Mono and stereo output routines
do not use the output map. The default maps built by
create_channel_map() pass unchanged.

Give the two mono to 5.1 routines the same side channel fallback the
other 5.1 routines already have, and look the side channels up in the
output map in upmix32bit_quatro_to_5_1() instead of the input map, so
that the rule checked at init matches what every 5.1 routine writes.

Signed-off-by: Shrushti P K <shrusthi@labs.digiscrypt.com>
@sofci

sofci commented Nov 3, 2026

Copy link
Copy Markdown
Collaborator

Can one of the admins verify this patch?

reply test this please to run this test once

@intel-sofci

Copy link
Copy Markdown

PR 11392: test results

Run date: 2026-11-03 07:43 UTC

Tested commit: 9cb761d7f9800d4299dd3fd57981b6848d1af597

mtl pass rate lnl pass rate ptl pass rate wcl pass rate nvl pass rate

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants