[PATCH 1/2] ASoC: SDCA: Improve scanning the SWFT during FDL

[PATCH 1/2] ASoC: SDCA: Improve scanning the SWFT during FDL

[Maciej Strozek]

Walking through SWFT is now improved to verify if it is not reading
past the end of the table.

Introduce file length checks that are done for SWFs from disk to files
from SWFT too.

Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities")
Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_fdl.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/sound/soc/sdca/sdca_fdl.c b/sound/soc/sdca/sdca_fdl.c
index 150e36ed24bcc..e08a553e0eab0 100644
--- a/sound/soc/sdca/sdca_fdl.c
+++ b/sound/soc/sdca/sdca_fdl.c
@@ -199,7 +199,6 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
 	struct sdca_fdl_file *fdl_file;
 	char *disk_filename;
 	int ret;
-	int i;
 
 	if (!set) {
 		dev_err(dev, "request to load SWF with no set\n");
@@ -209,9 +208,18 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
 	fdl_file = &set->files[file_index];
 
 	if (fdl_data->swft) {
-		tmp = fdl_data->swft->files;
-		for (i = 0; i < fdl_data->swft->header.length; i += tmp->file_length,
-		     tmp = ACPI_ADD_PTR(struct acpi_sw_file, tmp, tmp->file_length)) {
+		struct acpi_sw_file *table_end, *next;
+
+		table_end = ACPI_ADD_PTR(struct acpi_sw_file, fdl_data->swft,
+					 fdl_data->swft->header.length);
+		for (tmp = fdl_data->swft->files; tmp + 1 <= table_end; tmp = next) {
+			next = ACPI_ADD_PTR(struct acpi_sw_file, tmp, tmp->file_length);
+
+			if (tmp->file_length < sizeof(*tmp) || next > table_end) {
+				dev_err(dev, "bad file length in SWFT: %u\n", tmp->file_length);
+				break;
+			}
+
 			if (tmp->vendor_id == fdl_file->vendor_id &&
 			    tmp->file_id == fdl_file->file_id) {
 				dev_dbg(dev, "located SWF in ACPI: %x-%x-%x\n",

base-commit: 260a144af70c8babbf2f15d1a56bacfa83f8aef6
-- 
2.47.3

[PATCH 2/2] ASoC: SDCA: Check return value on a missing FDL_Set_Index Range

[Maciej Strozek]

In case of a missing FDL_Set_Index control the return value can be NULL,
ensure the functions returns before passing it on to range search.

Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities")
Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_fdl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/sdca/sdca_fdl.c b/sound/soc/sdca/sdca_fdl.c
index e08a553e0eab0..7fc809707944d 100644
--- a/sound/soc/sdca/sdca_fdl.c
+++ b/sound/soc/sdca/sdca_fdl.c
@@ -301,6 +301,8 @@ static struct sdca_fdl_set *fdl_get_set(struct sdca_interrupt *interrupt)
 
 	range = sdca_selector_find_range(dev, xu, SDCA_CTL_XU_FDL_SET_INDEX,
 					 SDCA_FDL_SET_INDEX_NCOLS, 0);
+	if (!range)
+		return NULL;
 
 	val = sdca_range_search(range, SDCA_FDL_SET_INDEX_SET_NUMBER,
 				val, SDCA_FDL_SET_INDEX_FILE_SET_ID);
-- 
2.47.3

Re: [PATCH 1/2] ASoC: SDCA: Improve scanning the SWFT during FDL

[Charles Keepax]

On Thu, Sep 17, 2026 at 11:33:59AM +0100, Maciej Strozek wrote:
> Walking through SWFT is now improved to verify if it is not reading
> past the end of the table.
> 
> Introduce file length checks that are done for SWFs from disk to files
> from SWFT too.
> 
> Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities")
> Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
> ---

Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>

Thanks,
Charles

Re: [PATCH 2/2] ASoC: SDCA: Check return value on a missing FDL_Set_Index Range

[Charles Keepax]

On Thu, Sep 17, 2026 at 11:34:00AM +0100, Maciej Strozek wrote:
> In case of a missing FDL_Set_Index control the return value can be NULL,
> ensure the functions returns before passing it on to range search.
> 
> Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities")
> Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
> ---

Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>

Thanks,
Charles

Re: [PATCH 1/2] ASoC: SDCA: Improve scanning the SWFT during FDL

[Mark Brown]

On Thu, 17 Sep 2026 11:33:59 +0100, Maciej Strozek wrote:
> ASoC: SDCA: Improve scanning the SWFT during FDL

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-7.4

Thanks!

[1/2] ASoC: SDCA: Improve scanning the SWFT during FDL
      https://git.kernel.org/broonie/sound/c/4454102d6565
[2/2] ASoC: SDCA: Check return value on a missing FDL_Set_Index Range
      https://git.kernel.org/broonie/sound/c/dfd8940277c9

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark