ipc4: large_config: fix data_off_size underflow on init-only block

ipc4_set_vendor_config_module_instance() only validated data_off_size in
the bursted-config path (init_block && final_block). The else path with
init_block == 1 && final_block == 0 unconditionally executed:

	data += sizeof(struct sof_tlv);
	data_off_size -= sizeof(struct sof_tlv);

data_off_size is a host-controlled 20-bit field taken straight from the
IPC message. When it is smaller than sizeof(struct sof_tlv) (8) the
subtraction underflows and wraps to a value close to 0xFFFFFFFF, which is
then forwarded as the length to the module's set_large_config() handler.
The actual backing buffer is only the MAILBOX_HOSTBOX_SIZE mailbox, so a
compromised host could trigger out-of-bounds reads of DSP SRAM (and
possible corruption depending on the target module) by sending
MOD_LARGE_CONFIG_SET with init_block=1, final_block=0 and
data_off_size < 8.

Hoist the existing "data_off_size < sizeof(struct sof_tlv) ||
data_off_size > MAILBOX_HOSTBOX_SIZE" bounds check to the top of the
function so it runs for every entry, before any pointer or size
arithmetic. The duplicate check in the bursted-config branch is removed
as it is now covered by the hoisted one.

Signed-off-by: Jyri Sarha <jyri.sarha@linux.intel.com>

Author: Jyri Sarha

src/ipc/ipc4/handler-user.c

@@ -1109,15 +1109,13 @@ __cold static int ipc4_set_vendor_config_module_instance(struct comp_dev *dev,
 
 	assert_can_be_cold();
 
+	/* Validate the host-controlled payload size before any use or arithmetic. */
+	if (data_off_size < sizeof(struct sof_tlv) || data_off_size > MAILBOX_HOSTBOX_SIZE)
+		return IPC4_INVALID_CONFIG_DATA_STRUCT;
+
 	/* Old FW comment: bursted configs */
 	if (init_block && final_block) {
 		const struct sof_tlv *tlv = (struct sof_tlv *)data;
-		/* if there is no payload in this large config set
-		 * (4 bytes type | 4 bytes length=0 | no value)
-		 * we do not handle such case
-		 */
-		if (data_off_size < sizeof(struct sof_tlv) || data_off_size > MAILBOX_HOSTBOX_SIZE)
-			return IPC4_INVALID_CONFIG_DATA_STRUCT;
 
 		/* ===Iterate over payload===
 		 * Payload can have multiple sof_tlv structures inside,