• Richard Fitzgerald's avatar
    firmware: cs_dsp: Fix overflow checking of wmfw header · 3019b86b
    Richard Fitzgerald authored
    Fix the checking that firmware file buffer is large enough for the
    wmfw header, to prevent overrunning the buffer.
    
    The original code tested that the firmware data buffer contained
    enough bytes for the sums of the size of the structs
    
    	wmfw_header + wmfw_adsp1_sizes + wmfw_footer
    
    But wmfw_adsp1_sizes is only used on ADSP1 firmware. For ADSP2 and
    Halo Core the equivalent struct is wmfw_adsp2_sizes, which is
    4 bytes longer. So the length check didn't guarantee that there
    are enough bytes in the firmware buffer for a header with
    wmfw_adsp2_sizes.
    
    This patch splits the length check into three separate parts. Each
    of the wmfw_header, wmfw_adsp?_sizes and wmfw_footer are checked
    separately before they are used.
    Signed-off-by: default avatarRichard Fitzgerald <rf@opensource.cirrus.com>
    Fixes: f6bc909e ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs")
    Link: https://patch.msgid.link/20240627141432.93056-2-rf@opensource.cirrus.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
    3019b86b
cs_dsp.c 89.2 KB