[PATCH 0/4] Series of SDCA bug fixes

[PATCH 0/4] Series of SDCA bug fixes

[Charles Keepax]

Fix up some error path and size checking issues in the SDCA code.

Thanks,
Charles

Charles Keepax (4):
  ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
  ASoC: SDCA: Always free firmware in FDL path
  ASoC: SDCA: Make UMP message size check more robust
  ASoC: SDCA: Ensure that Control Range is large enough for header

 sound/soc/sdca/sdca_device.c    | 2 +-
 sound/soc/sdca/sdca_fdl.c       | 5 ++++-
 sound/soc/sdca/sdca_functions.c | 2 ++
 sound/soc/sdca/sdca_ump.c       | 4 ++--
 4 files changed, 9 insertions(+), 4 deletions(-)

-- 
2.47.3

[PATCH 1/4] ASoC: SDCA: Correct pointer passed to devm_acpi_table_put

[Charles Keepax]

devm_acpi_table_put() takes a struct acpi_table_header * but the value
passed in is struct acpi_table_header ** so the value passed to
acpi_put_table() is actually the pointer not the table itself.

Remove the extra reference to correct the passed value.

Fixes: c4d096c3ca42 ("ASoC: SDCA: Add SDCA FDL data parsing")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/sdca/sdca_device.c b/sound/soc/sdca/sdca_device.c
index 405e80b979de8..4bcd8d1fdff82 100644
--- a/sound/soc/sdca/sdca_device.c
+++ b/sound/soc/sdca/sdca_device.c
@@ -43,7 +43,7 @@ void sdca_lookup_swft(struct sdw_slave *slave)
 		dev_info(&slave->dev, "SWFT not available\n");
 	else
 		devm_add_action_or_reset(&slave->dev, devm_acpi_table_put,
-					 &slave->sdca_data.swft);
+					 slave->sdca_data.swft);
 }
 EXPORT_SYMBOL_NS(sdca_lookup_swft, "SND_SOC_SDCA");
 
-- 
2.47.3

[PATCH 2/4] ASoC: SDCA: Always free firmware in FDL path

[Charles Keepax]

In the case a disk firmware exists but is invalid and no SWFT firmware
exists fdl_load_file() will return without calling release_firmware().
Update the code to call this to ensure the firmware is released on the
error path.

Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_fdl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sound/soc/sdca/sdca_fdl.c b/sound/soc/sdca/sdca_fdl.c
index 994821a6df617..60fdd406220d4 100644
--- a/sound/soc/sdca/sdca_fdl.c
+++ b/sound/soc/sdca/sdca_fdl.c
@@ -258,7 +258,8 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
 
 	if (!swf) {
 		dev_err(dev, "failed to locate SWF\n");
-		return -ENOENT;
+		ret = -ENOENT;
+		goto error;
 	}
 
 	dev_info(dev, "loading SWF: %x-%x-%x\n",
@@ -270,6 +271,8 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
 				     SDCA_CTL_XU_FDL_MESSAGEOFFSET, fdl_file->fdl_offset,
 				     SDCA_CTL_XU_FDL_MESSAGELENGTH, swf->data,
 				     swf->file_length - offsetof(struct acpi_sw_file, data));
+
+error:
 	release_firmware(firmware);
 	return ret;
 }
-- 
2.47.3

[PATCH 3/4] ASoC: SDCA: Make UMP message size check more robust

[Charles Keepax]

If message offset was larger than the buffer length the size
check will pass incorrectly. Refactor the check such that it is
more robust to invalid sizes.

Fixes: daab108504be ("ASoC: SDCA: Add UMP buffer helper functions")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_ump.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/sdca/sdca_ump.c b/sound/soc/sdca/sdca_ump.c
index a86bb28c6d0ad..82a8bf75bbca5 100644
--- a/sound/soc/sdca/sdca_ump.c
+++ b/sound/soc/sdca/sdca_ump.c
@@ -141,7 +141,7 @@ int sdca_ump_read_message(struct device *dev,
 		return ret;
 	}
 
-	if (msg_len > buf_len - msg_offset) {
+	if (msg_offset + msg_len > buf_len) {
 		dev_err(dev, "%s: message too big for UMP buffer: %d\n",
 			entity->label, msg_len);
 		return -EINVAL;
@@ -207,7 +207,7 @@ int sdca_ump_write_message(struct device *dev,
 	buf_len = sdca_range(range, SDCA_MESSAGEOFFSET_BUFFER_LENGTH, 0);
 	ump_mode = sdca_range(range, SDCA_MESSAGEOFFSET_UMP_MODE, 0);
 
-	if (msg_len > buf_len - msg_offset) {
+	if (msg_offset + msg_len > buf_len) {
 		dev_err(dev, "%s: message too big for UMP buffer: %d\n",
 			entity->label, msg_len);
 		return -EINVAL;
-- 
2.47.3

[PATCH 4/4] ASoC: SDCA: Ensure that Control Range is large enough for header

[Charles Keepax]

When reading the Ranges structure from an SDCA Control, ensure that the
read data is large enough to encompass the required header before
accessing it.

Fixes: 64fb5af1d1bb ("ASoC: SDCA: Add parsing for Control range structures")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
 sound/soc/sdca/sdca_functions.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/sdca/sdca_functions.c b/sound/soc/sdca/sdca_functions.c
index 77940bd6b33c9..7a7a9f1a49389 100644
--- a/sound/soc/sdca/sdca_functions.c
+++ b/sound/soc/sdca/sdca_functions.c
@@ -855,6 +855,8 @@ static int find_sdca_control_range(struct device *dev,
 		return 0;
 	else if (num_range < 0)
 		return num_range;
+	else if (num_range < 2 * sizeof(*limits))
+		return -EINVAL;
 
 	range_list = devm_kcalloc(dev, num_range, sizeof(*range_list), GFP_KERNEL);
 	if (!range_list)
-- 
2.47.3

Re: [PATCH 0/4] Series of SDCA bug fixes

[Pierre-Louis Bossart]

On 7/22/26 12:34, Charles Keepax wrote:
> Fix up some error path and size checking issues in the SDCA code.
> 
> Thanks,
> Charles
> 
> Charles Keepax (4):
>   ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
>   ASoC: SDCA: Always free firmware in FDL path
>   ASoC: SDCA: Make UMP message size check more robust
>   ASoC: SDCA: Ensure that Control Range is large enough for header

LGTM

Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>

> 
>  sound/soc/sdca/sdca_device.c    | 2 +-
>  sound/soc/sdca/sdca_fdl.c       | 5 ++++-
>  sound/soc/sdca/sdca_functions.c | 2 ++
>  sound/soc/sdca/sdca_ump.c       | 4 ++--
>  4 files changed, 9 insertions(+), 4 deletions(-)
> 

Re: [PATCH 0/4] Series of SDCA bug fixes

[Mark Brown]

On Wed, 22 Jul 2026 11:34:56 +0100, Charles Keepax wrote:
> Series of SDCA bug fixes
> 
> Fix up some error path and size checking issues in the SDCA code.
> 
> Thanks,
> Charles
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-7.2

Thanks!

[1/4] ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
      https://git.kernel.org/broonie/sound/c/6a50332e194f
[2/4] ASoC: SDCA: Always free firmware in FDL path
      https://git.kernel.org/broonie/sound/c/7f64ccc374b2
[3/4] ASoC: SDCA: Make UMP message size check more robust
      https://git.kernel.org/broonie/sound/c/556d872e7c2a
[4/4] ASoC: SDCA: Ensure that Control Range is large enough for header
      https://git.kernel.org/broonie/sound/c/951e921b039b

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark