On Sat, Jul 11, 2026 at 02:23:12AM +0500, Muhammad Bilal wrote:
The Greybus audio topology parser trusts length and count fields taken straight from the module's topology blob and never checks them against the size of the buffer it actually allocated, leading to out-of-bounds reads of the kernel heap.
gb_audio_gb_get_topology() reads a u16 size from the module, allocates a buffer of that size, fetches the topology into it, and then discards the size. gbaudio_tplg_parse_data() then walks that buffer using fields stored inside it:
gbaudio_tplg_process_header() computes the control, widget and route block offsets by adding the wire-supplied __le32 size_dais, size_controls and size_widgets onto the buffer base with no bound, so a module that reports a small allocation size but large block sizes moves those offsets far past the end of the buffer before they are dereferenced.
gbaudio_tplg_process_kcontrols(), _process_widgets() and _process_routes() iterate num_controls / num_widgets / num_routes (also from the blob) and advance a pointer by a per-element size that includes the __le16 names_length of an enumerated control, again with no check that the element stays inside the buffer.
gb_generate_enum_strings() loops over an attacker-controlled __le32 items count and, for each, scans for a NUL terminator with no end pointer, walking off the end of the buffer.
A malicious or malfunctioning module can therefore make the parser read past the allocation. The wild block offsets are most likely to hit an unmapped page and oops (denial of service); the byte-at-a-time enum scan walks from a still-valid pointer and can copy adjacent heap bytes into ALSA control name strings, which are readable by unprivileged local users, so an information leak cannot be ruled out.
Thread the allocated topology size from gb_audio_gb_get_topology() through to gbaudio_tplg_parse_data() and bound every walk against the end of the buffer: verify the block offsets are ordered and within the buffer (the "< previous" tests also catch a 32-bit unsigned wrap of the running offset), check each control, widget and route lies fully inside its block before use, and give gb_generate_enum_strings() an explicit end pointer plus an items-versus-names_length sanity check.
Fixes: 6339d2322c47 ("greybus: audio: Add topology parser for GB codec") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal meatuni001@gmail.com
How was this found, and tested?
thanks,
greg k-h