diff options
| author | Ștefan Ghețu <stefanghetu9@gmail.com> | 2026-09-08 20:07:40 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2026-09-16 22:08:56 +0100 |
| commit | 48ed992bfbe53537ad1cbc8ad68f7031e7ac0af3 (patch) | |
| tree | f6522a5424a4d938a1e5937a76f33991ad7231f4 /tools/lib/python/kdoc | |
| parent | 98fe8aab04cec6fcadeb10a757235225d550be36 (diff) | |
ASoC: SOF: imx: Prevent stack OOB read in DSP panic dump
Commit 58bb5081cba1 ("ASoC: SOF: Xtensa: dump ar registers to restore
call stack") added a shared Xtensa helper that iterates over a flexible
array of AR registers (`ar[]`) controlled by `plat_hdr.numaregs`.
While Intel IPC4 allocates dynamic storage for the AR block, the i.MX
IPC3 path reads the oops message into a stack-allocated struct without
backing storage for `ar[]`, while leaving `numaregs` unvalidated. This
causes a stack out-of-bounds read when printing a DSP panic.
Clear `numaregs` to 0 on i.MX since the AR block is not fetched or
supported on this platform, preventing unsafe out-of-bounds memory
accesses in the shared Xtensa helper.
Fixes: 58bb5081cba1 ("ASoC: SOF: Xtensa: dump ar registers to restore call stack")
Signed-off-by: Ștefan Ghețu <stefanghetu9@gmail.com>
Link: https://patch.msgid.link/20260908170740.276800-1-stefanghetu9@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc')
0 files changed, 0 insertions, 0 deletions