Repository navigation
Conversation
zephyr_ll_user_heap() returned zephyr_ll_heap, a pointer stored in user-writable memory (APP_SYSUSER_DATA). Kernel code reaching it through sof_sys_user_heap_get(), for example dma_init() under the sof_dma_get() system call or the data blob allocations under mod_data_blob_handler_new(), would then run the heap code in supervisor mode on whatever k_heap a user thread had pointed it at. The heap object's address is a link-time constant, so return it directly. User threads can still call the function, as taking the address reads no kernel memory, and the heap system call validators already compare the pointer with this address. The user-writable copy is no longer needed and is removed. zephyr_ll_user_resources_init() runs before platform_init(), so no caller relies on the old NULL return before initialization. Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
kv2019i
requested review from
LaurentiuM1234,
dbaluta,
lbetlej,
lgirdwood,
marcinszkudlinski,
mmaka1,
pblaszko and
plbossart
as code owners
October 27, 2026 11:10
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused change removes an untrusted pointer dependency while preserving validator consistency and initialization ordering.
No open issues 🎉
What changed in this PR
This PR hardens the LL scheduler’s heap accessor so kernel callers no longer rely on a heap pointer stored in user-writable memory.
Changes:
- Return the kernel heap object’s address directly and remove the user-writable pointer and its initialization.
- Update documentation to explain the accessor’s safety and heap-pointer validation.
| File | Description |
|---|---|
src/schedule/zephyr_ll_user.c |
Returns the heap address directly and documents safe kernel and user-space use. |
src/include/sof/userspace/README.md |
Updates the userspace guidance to reflect the direct-address accessor. |
Review effort: Balanced
PR 11365: test resultsRun date: 2026-10-27 12:35 UTC Tested commit: 59487c2de7bca7528dcf18a649021730daf4a153
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
zephyr_ll_user_heap() returned zephyr_ll_heap, a pointer stored in user-writable memory (APP_SYSUSER_DATA). Kernel code reaching it through sof_sys_user_heap_get(), for example dma_init() under the sof_dma_get() system call or the data blob allocations under mod_data_blob_handler_new(), would then run the heap code in supervisor mode on whatever k_heap a user thread had pointed it at.
The heap object's address is a link-time constant, so return it directly. User threads can still call the function, as taking the address reads no kernel memory, and the heap system call validators already compare the pointer with this address. The user-writable copy is no longer needed and is removed. zephyr_ll_user_resources_init() runs before platform_init(), so no caller relies on the old NULL return before initialization.