From 8464b522192f64cc7e733ae175b4503d44ff318d Mon Sep 17 00:00:00 2001 From: Adrian Bonislawski Date: Mon, 18 May 2026 10:57:43 +0200 Subject: [PATCH 1/3] ipc4: base_fw: fix duplicated word in comment Remove the repeated 'count' in the IPC4_MAX_SRC_QUEUE comment. Signed-off-by: Adrian Bonislawski --- src/include/ipc4/base_fw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/include/ipc4/base_fw.h b/src/include/ipc4/base_fw.h index 289ab76830e3..1a7469354d20 100644 --- a/src/include/ipc4/base_fw.h +++ b/src/include/ipc4/base_fw.h @@ -23,7 +23,7 @@ */ #define IPC4_MAX_CLK_STATES 0 -/* Max src queue count count supported by ipc4 */ +/* Max src queue count supported by ipc4 */ #define IPC4_MAX_SRC_QUEUE 8 /* Max module instance for single module count supported by ipc4 */ From cb7a692ade1cec54001f618732b90d0758b555b4 Mon Sep 17 00:00:00 2001 From: Adrian Bonislawski Date: Mon, 18 May 2026 10:51:52 +0200 Subject: [PATCH 2/3] ipc4: base_fw: add IPC4_MAX_DST_QUEUE constant Add IPC4_MAX_DST_QUEUE (value 8) as the symmetric counterpart to IPC4_MAX_SRC_QUEUE, representing the maximum destination/output pin queue count supported by the IPC4 protocol. Signed-off-by: Adrian Bonislawski --- src/include/ipc4/base_fw.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/include/ipc4/base_fw.h b/src/include/ipc4/base_fw.h index 1a7469354d20..2ae358010c2d 100644 --- a/src/include/ipc4/base_fw.h +++ b/src/include/ipc4/base_fw.h @@ -26,6 +26,9 @@ /* Max src queue count supported by ipc4 */ #define IPC4_MAX_SRC_QUEUE 8 +/* Max dst queue count supported by ipc4 */ +#define IPC4_MAX_DST_QUEUE 8 + /* Max module instance for single module count supported by ipc4 */ #define IPC4_MAX_MODULE_INSTANCES 256 From bb166040e4c1ed80c1a48835255e63ccf95bfe3f Mon Sep 17 00:00:00 2001 From: Adrian Bonislawski Date: Mon, 18 May 2026 10:55:04 +0200 Subject: [PATCH 3/3] module_adapter: ipc4: validate pin counts against IPC4 maximum Reject IPC4 module init payloads where nb_input_pins or nb_output_pins exceed the protocol maximum (IPC4_MAX_SRC_QUEUE / IPC4_MAX_DST_QUEUE = 8). The existing cfgsz equality check ensures the immediate pointer arithmetic is in-bounds, but it does not prevent unsupported pin counts from being stored in dst->nb_input_pins / dst->nb_output_pins and used by downstream module code. Add explicit upper-bound validation before computing pinsz, matching the IPC4 ABI contract advertised via IPC4_MAX_MODULE_PIN_COUNT_FW_CFG. Signed-off-by: Adrian Bonislawski --- src/audio/module_adapter/module_adapter_ipc4.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/audio/module_adapter/module_adapter_ipc4.c b/src/audio/module_adapter/module_adapter_ipc4.c index 092f93314bac..959f51bbf03a 100644 --- a/src/audio/module_adapter/module_adapter_ipc4.c +++ b/src/audio/module_adapter/module_adapter_ipc4.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include @@ -145,6 +146,9 @@ int module_adapter_init_data(struct comp_dev *dev, + (n_out * sizeof(*dst->output_pins)); if (cfgsz == (sizeof(*cfg) + pinsz)) { + if (n_in > IPC4_MAX_SRC_QUEUE || n_out > IPC4_MAX_DST_QUEUE) + return -EINVAL; + dst->nb_input_pins = n_in; dst->nb_output_pins = n_out; dst->input_pins = sof_heap_alloc(dev->mod->priv.resources.alloc->heap,