[PATCH 1/2] ASoC: SDCA: Improve scanning the SWFT during FDL

[PATCH 1/2] ASoC: SDCA: Improve scanning the SWFT during FDL

[Maciej Strozek]

Walking through SWFT is now improved to verify if it is not reading
past the end of the table.

Introduce file length checks that are done for SWFs from disk to files
from SWFT too.

Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities")
Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_fdl.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/sound/soc/sdca/sdca_fdl.c b/sound/soc/sdca/sdca_fdl.c
index 150e36ed24bcc..e08a553e0eab0 100644
--- a/sound/soc/sdca/sdca_fdl.c
+++ b/sound/soc/sdca/sdca_fdl.c
@@ -199,7 +199,6 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
 	struct sdca_fdl_file *fdl_file;
 	char *disk_filename;
 	int ret;
-	int i;
 
 	if (!set) {
 		dev_err(dev, "request to load SWF with no set\n");
@@ -209,9 +208,18 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
 	fdl_file = &set->files[file_index];
 
 	if (fdl_data->swft) {
-		tmp = fdl_data->swft->files;
-		for (i = 0; i < fdl_data->swft->header.length; i += tmp->file_length,
-		     tmp = ACPI_ADD_PTR(struct acpi_sw_file, tmp, tmp->file_length)) {
+		struct acpi_sw_file *table_end, *next;
+
+		table_end = ACPI_ADD_PTR(struct acpi_sw_file, fdl_data->swft,
+					 fdl_data->swft->header.length);
+		for (tmp = fdl_data->swft->files; tmp + 1 <= table_end; tmp = next) {
+			next = ACPI_ADD_PTR(struct acpi_sw_file, tmp, tmp->file_length);
+
+			if (tmp->file_length < sizeof(*tmp) || next > table_end) {
+				dev_err(dev, "bad file length in SWFT: %u\n", tmp->file_length);
+				break;
+			}
+
 			if (tmp->vendor_id == fdl_file->vendor_id &&
 			    tmp->file_id == fdl_file->file_id) {
 				dev_dbg(dev, "located SWF in ACPI: %x-%x-%x\n",

base-commit: 260a144af70c8babbf2f15d1a56bacfa83f8aef6
-- 
2.47.3

[PATCH 2/2] ASoC: SDCA: Check return value on a missing FDL_Set_Index Range

[Maciej Strozek]

In case of a missing FDL_Set_Index control the return value can be NULL,
ensure the functions returns before passing it on to range search.

Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities")
Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_fdl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/sdca/sdca_fdl.c b/sound/soc/sdca/sdca_fdl.c
index e08a553e0eab0..7fc809707944d 100644
--- a/sound/soc/sdca/sdca_fdl.c
+++ b/sound/soc/sdca/sdca_fdl.c
@@ -301,6 +301,8 @@ static struct sdca_fdl_set *fdl_get_set(struct sdca_interrupt *interrupt)
 
 	range = sdca_selector_find_range(dev, xu, SDCA_CTL_XU_FDL_SET_INDEX,
 					 SDCA_FDL_SET_INDEX_NCOLS, 0);
+	if (!range)
+		return NULL;
 
 	val = sdca_range_search(range, SDCA_FDL_SET_INDEX_SET_NUMBER,
 				val, SDCA_FDL_SET_INDEX_FILE_SET_ID);
-- 
2.47.3