[PATCH 0/4] Series of SDCA bug fixes

[PATCH 0/4] Series of SDCA bug fixes

[Charles Keepax]

Fix up some error path and size checking issues in the SDCA code.

Thanks,
Charles

Charles Keepax (4):
  ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
  ASoC: SDCA: Always free firmware in FDL path
  ASoC: SDCA: Make UMP message size check more robust
  ASoC: SDCA: Ensure that Control Range is large enough for header

 sound/soc/sdca/sdca_device.c    | 2 +-
 sound/soc/sdca/sdca_fdl.c       | 5 ++++-
 sound/soc/sdca/sdca_functions.c | 2 ++
 sound/soc/sdca/sdca_ump.c       | 4 ++--
 4 files changed, 9 insertions(+), 4 deletions(-)

-- 
2.47.3

[PATCH 1/4] ASoC: SDCA: Correct pointer passed to devm_acpi_table_put

[Charles Keepax]

devm_acpi_table_put() takes a struct acpi_table_header * but the value
passed in is struct acpi_table_header ** so the value passed to
acpi_put_table() is actually the pointer not the table itself.

Remove the extra reference to correct the passed value.

Fixes: c4d096c3ca42 ("ASoC: SDCA: Add SDCA FDL data parsing")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/sdca/sdca_device.c b/sound/soc/sdca/sdca_device.c
index 405e80b979de8..4bcd8d1fdff82 100644
--- a/sound/soc/sdca/sdca_device.c
+++ b/sound/soc/sdca/sdca_device.c
@@ -43,7 +43,7 @@ void sdca_lookup_swft(struct sdw_slave *slave)
 		dev_info(&slave->dev, "SWFT not available\n");
 	else
 		devm_add_action_or_reset(&slave->dev, devm_acpi_table_put,
-					 &slave->sdca_data.swft);
+					 slave->sdca_data.swft);
 }
 EXPORT_SYMBOL_NS(sdca_lookup_swft, "SND_SOC_SDCA");
 
-- 
2.47.3

[PATCH 2/4] ASoC: SDCA: Always free firmware in FDL path

[Charles Keepax]

In the case a disk firmware exists but is invalid and no SWFT firmware
exists fdl_load_file() will return without calling release_firmware().
Update the code to call this to ensure the firmware is released on the
error path.

Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_fdl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sound/soc/sdca/sdca_fdl.c b/sound/soc/sdca/sdca_fdl.c
index 994821a6df617..60fdd406220d4 100644
--- a/sound/soc/sdca/sdca_fdl.c
+++ b/sound/soc/sdca/sdca_fdl.c
@@ -258,7 +258,8 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
 
 	if (!swf) {
 		dev_err(dev, "failed to locate SWF\n");
-		return -ENOENT;
+		ret = -ENOENT;
+		goto error;
 	}
 
 	dev_info(dev, "loading SWF: %x-%x-%x\n",
@@ -270,6 +271,8 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
 				     SDCA_CTL_XU_FDL_MESSAGEOFFSET, fdl_file->fdl_offset,
 				     SDCA_CTL_XU_FDL_MESSAGELENGTH, swf->data,
 				     swf->file_length - offsetof(struct acpi_sw_file, data));
+
+error:
 	release_firmware(firmware);
 	return ret;
 }
-- 
2.47.3

[PATCH 3/4] ASoC: SDCA: Make UMP message size check more robust

[Charles Keepax]

If message offset was larger than the buffer length the size
check will pass incorrectly. Refactor the check such that it is
more robust to invalid sizes.

Fixes: daab108504be ("ASoC: SDCA: Add UMP buffer helper functions")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_ump.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/sdca/sdca_ump.c b/sound/soc/sdca/sdca_ump.c
index a86bb28c6d0ad..82a8bf75bbca5 100644
--- a/sound/soc/sdca/sdca_ump.c
+++ b/sound/soc/sdca/sdca_ump.c
@@ -141,7 +141,7 @@ int sdca_ump_read_message(struct device *dev,
 		return ret;
 	}
 
-	if (msg_len > buf_len - msg_offset) {
+	if (msg_offset + msg_len > buf_len) {
 		dev_err(dev, "%s: message too big for UMP buffer: %d\n",
 			entity->label, msg_len);
 		return -EINVAL;
@@ -207,7 +207,7 @@ int sdca_ump_write_message(struct device *dev,
 	buf_len = sdca_range(range, SDCA_MESSAGEOFFSET_BUFFER_LENGTH, 0);
 	ump_mode = sdca_range(range, SDCA_MESSAGEOFFSET_UMP_MODE, 0);
 
-	if (msg_len > buf_len - msg_offset) {
+	if (msg_offset + msg_len > buf_len) {
 		dev_err(dev, "%s: message too big for UMP buffer: %d\n",
 			entity->label, msg_len);
 		return -EINVAL;
-- 
2.47.3

[PATCH 4/4] ASoC: SDCA: Ensure that Control Range is large enough for header

[Charles Keepax]

When reading the Ranges structure from an SDCA Control, ensure that the
read data is large enough to encompass the required header before
accessing it.

Fixes: 64fb5af1d1bb ("ASoC: SDCA: Add parsing for Control range structures")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_functions.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/sdca/sdca_functions.c b/sound/soc/sdca/sdca_functions.c
index 77940bd6b33c9..7a7a9f1a49389 100644
--- a/sound/soc/sdca/sdca_functions.c
+++ b/sound/soc/sdca/sdca_functions.c
@@ -855,6 +855,8 @@ static int find_sdca_control_range(struct device *dev,
 		return 0;
 	else if (num_range < 0)
 		return num_range;
+	else if (num_range < 2 * sizeof(*limits))
+		return -EINVAL;
 
 	range_list = devm_kcalloc(dev, num_range, sizeof(*range_list), GFP_KERNEL);
 	if (!range_list)
-- 
2.47.3

Re: [PATCH 0/4] Series of SDCA bug fixes

[Pierre-Louis Bossart]

On 7/22/26 12:34, Charles Keepax wrote:
> Fix up some error path and size checking issues in the SDCA code.
> 
> Thanks,
> Charles
> 
> Charles Keepax (4):
>   ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
>   ASoC: SDCA: Always free firmware in FDL path
>   ASoC: SDCA: Make UMP message size check more robust
>   ASoC: SDCA: Ensure that Control Range is large enough for header

LGTM

Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>

> 
>  sound/soc/sdca/sdca_device.c    | 2 +-
>  sound/soc/sdca/sdca_fdl.c       | 5 ++++-
>  sound/soc/sdca/sdca_functions.c | 2 ++
>  sound/soc/sdca/sdca_ump.c       | 4 ++--
>  4 files changed, 9 insertions(+), 4 deletions(-)
>