[BUG] Out-of-bounds write reassembling a multi-fragment SET_LARGE_CONFIG

[tmleman]

Describe the bug

A large config set allows sending configs that do not fit in the mailbox as a sequence of several IPCs. The IPC4 Fuzzer generated a sequence of messages that enables an OOB write on the heap.

To Reproduce

Bug discovered in a fuzzer run in CI on native_sim: https://github.com/thesofproject/sof/actions/runs/32472030094/job/96740635100?pr=11112

The bug itself is not related to the changes in the pull request and was reproducible on main beforehand.

Fuzzer input (base64):

AAAAAAAAAAAAAAAACQAAPwAxAAEGqgAAADEABAAA4OADAADi/v////////8AADGqBgABAADg4AOT
AAAIADGqBgABAAAAMQAEAAAACQAACAAxqgYA+AAAADEABAAA5OAAACUABAAE4eADAADgAAAAAAAA
AAAAAAAAAAAA4OADADJsbGwAAAAAAAAAAAAAAAAJAAAIAAAAAAAAAAAACQAACAAxqgYA+AAAADEA
BAAA5OCqMWxsbGyTCQAACKoxbGxsb5P/v9kGADEAAAAlAAQABOHgAwAAqgYA+AAAADEABAAA5OAY
AAAABAAE4eADAAAAAAAAAAAAAAkAAAgAMaoGAPgAAAAxAAQAAOTgAAAlAAQABOHgAwAA4AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcAAACqAQABAAAAMgAEAPT//38AAAAAFwAA

Screenshots or console output

=================================================================
==5456==ERROR: AddressSanitizer: use-after-poison on address 0x088cba80 at pc 0x081835dc bp 0xdb6dfeb8 sp 0xdb6dfeb0
WRITE of size 16 at 0x088cba80 thread T7
    #0 0x81835db in memcpy /home/runner/work/sof/sof/workspace/zephyr/lib/libc/minimal/source/string/string.c:321:16

0x088cba80 is located 13696 bytes inside of global variable 'heapmem' defined in '/home/runner/work/sof/sof/workspace/sof/zephyr/lib/alloc.c:118' (0x88c8500) of size 262144
SUMMARY: AddressSanitizer: use-after-poison /home/runner/work/sof/sof/workspace/zephyr/lib/libc/minimal/source/string/string.c:321:16 in memcpy
Shadow bytes around the buggy address:
  0x088cb800: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x088cb880: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x088cb900: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x088cb980: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x088cba00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x088cba80:[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x088cbb00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x088cbb80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x088cbc00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x088cbc80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x088cbd00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
Thread T7 created by T3 here:
    #0 0x81193b3 in pthread_create (/home/runner/work/sof/sof/workspace/build-fuzz/zephyr/zephyr.exe+0x81193b3) (BuildId: a383011259593d1b3cb405d7b8fb91691331ed25)
    #1 0x82bbd42 in nct_new_thread /home/runner/work/sof/sof/workspace/zephyr/scripts/native_simulator/common/src/nct.c:414:2
    #2 0x81814f6 in posix_new_thread /home/runner/work/sof/sof/workspace/zephyr/arch/posix/core/posix_core_nsi.c:48:9
    #3 0x8180ee4 in arch_new_thread /home/runner/work/sof/sof/workspace/zephyr/arch/posix/core/thread.c:55:30
    #4 0x82acf98 in z_setup_new_thread /home/runner/work/sof/sof/workspace/zephyr/kernel/thread.c:904:2
    #5 0x82ad473 in z_impl_k_thread_create /home/runner/work/sof/sof/workspace/zephyr/kernel/thread.c:1004:2
    #6 0x82aac49 in k_thread_create /home/runner/work/sof/sof/workspace/build-fuzz/zephyr/include/generated/zephyr/syscalls/kernel.h:82:9
    #7 0x82aac49 in k_work_queue_start /home/runner/work/sof/sof/workspace/zephyr/kernel/work.c:879:8
    #8 0x82a2806 in scheduler_init_edf /home/runner/work/sof/sof/workspace/sof/zephyr/edf_schedule.c:111:2
    #9 0x82a2017 in platform_init /home/runner/work/sof/sof/workspace/sof/src/platform/posix/posix.c:77:2
    #10 0x8277f12 in primary_core_init /home/runner/work/sof/sof/workspace/sof/src/init/init.c:236:6
    #11 0x82a6574 in z_sys_init_run_level /home/runner/work/sof/sof/workspace/zephyr/kernel/init.c:241:13
    #12 0x82a6574 in bg_thread_main /home/runner/work/sof/sof/workspace/zephyr/kernel/init.c:303:2
    #13 0x81806f2 in z_thread_entry /home/runner/work/sof/sof/workspace/zephyr/kernel/sys/thread_entry.c:60:2

Thread T3 created by T2 here:
    #0 0x81193b3 in pthread_create (/home/runner/work/sof/sof/workspace/build-fuzz/zephyr/zephyr.exe+0x81193b3) (BuildId: a383011259593d1b3cb405d7b8fb91691331ed25)
    #1 0x82bbd42 in nct_new_thread /home/runner/work/sof/sof/workspace/zephyr/scripts/native_simulator/common/src/nct.c:414:2
    #2 0x81814f6 in posix_new_thread /home/runner/work/sof/sof/workspace/zephyr/arch/posix/core/posix_core_nsi.c:48:9
    #3 0x8180ee4 in arch_new_thread /home/runner/work/sof/sof/workspace/zephyr/arch/posix/core/thread.c:55:30
    #4 0x82acf98 in z_setup_new_thread /home/runner/work/sof/sof/workspace/zephyr/kernel/thread.c:904:2
    #5 0x82a6360 in prepare_multithreading /home/runner/work/sof/sof/workspace/zephyr/kernel/init.c:463:14
    #6 0x82a605c in z_cstart /home/runner/work/sof/sof/workspace/zephyr/kernel/init.c:594:24
    #7 0x82babb7 in sw_wrapper /home/runner/work/sof/sof/workspace/zephyr/scripts/native_simulator/common/src/nce.c:149:2
    #8 0x8131653 in asan_thread_start(void*) asan_interceptors.cpp.o

Thread T2 created by T0 here:
    #0 0x81193b3 in pthread_create (/home/runner/work/sof/sof/workspace/build-fuzz/zephyr/zephyr.exe+0x81193b3) (BuildId: a383011259593d1b3cb405d7b8fb91691331ed25)
    #1 0x82ba9a2 in nce_boot_cpu /home/runner/work/sof/sof/workspace/zephyr/scripts/native_simulator/common/src/nce.c:171:2
    #2 0x8184449 in posix_boot_cpu /home/runner/work/sof/sof/workspace/zephyr/soc/native/inf_clock/soc.c:126:2
    #3 0x82c8325 in nsif_cpu0_boot /home/runner/work/sof/sof/workspace/zephyr/boards/native/native_sim/nsi_if.c:24:2
    #4 0x82bdfa2 in nsif_cpun_boot /home/runner/work/sof/sof/workspace/zephyr/scripts/native_simulator/common/src/nsi_cpun_if.c:16:1
    #5 0x82bd85b in nsi_cpu_auto_boot /home/runner/work/sof/sof/workspace/zephyr/scripts/native_simulator/common/src/nsi_cpu_ctrl.c:38:4
    #6 0x82ba1a2 in nsi_init /home/runner/work/sof/sof/workspace/zephyr/scripts/native_simulator/common/src/main.c:87:2
    #7 0x82c84a9 in LLVMFuzzerTestOneInput /home/runner/work/sof/sof/workspace/sof/src/platform/posix/fuzz.c:40:3
    #8 0x80846d6 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned int) (/home/runner/work/sof/sof/workspace/build-fuzz/zephyr/zephyr.exe+0x80846d6) (BuildId: a383011259593d1b3cb405d7b8fb91691331ed25)
    #9 0x808567d in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/home/runner/work/sof/sof/workspace/build-fuzz/zephyr/zephyr.exe+0x808567d) (BuildId: a383011259593d1b3cb405d7b8fb91691331ed25)
    #10 0x8085c56 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/home/runner/work/sof/sof/workspace/build-fuzz/zephyr/zephyr.exe+0x8085c56) (BuildId: a383011259593d1b3cb405d7b8fb91691331ed25)
    #11 0x8073040 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned int)) (/home/runner/work/sof/sof/workspace/build-fuzz/zephyr/zephyr.exe+0x8073040) (BuildId: a383011259593d1b3cb405d7b8fb91691331ed25)
    #12 0x809d0cb in main (/home/runner/work/sof/sof/workspace/build-fuzz/zephyr/zephyr.exe+0x809d0cb) (BuildId: a383011259593d1b3cb405d7b8fb91691331ed25)
    #13 0xeb54dcb8  (/lib/i386-linux-gnu/libc.so.6+0x24cb8) (BuildId: a7e93008cd7dad7a713e3eaf1f9dec78ce7c68a6)

==5456==ABORTING
MS: 1 CrossOver-; base unit: 77fe0485e8dce041f1da19afcf82c2a6f1829b46
artifact_prefix='./'; Test unit written to ./crash-af727aa329c37f71404e2fcc7382accebaef4218

IPC sequence extracted during analysis

Step	Message	Effect
1	FIRST data_offset=224	allocates runtime_params = 224 bytes, new_cfg_size = 224
2	FIRST data_offset=109280	module_set_large_config sets new_cfg_size = 109280 (module_adapter_ipc4.c:246) before module_set_configuration() returns -EBUSY, runtime_params is still the 224-byte buffer
3	MIDDLE data_offset=6368, frag=4096	offset(6368) < new_cfg_size(109280) so the bound passes, but runtime_params is only 224 bytes. memcpy writes 4096 bytes at runtime_params+6368, OOB write (ASan use-after-poison at heapmem+13152)

[tmleman]

FYI @lyakh @abonislawski @lgirdwood