github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ASoC: Series of SDCA bug fixes

Browse Source 
Charles Keepax <ckeepax@opensource.cirrus.com> says:

Fix up some error path and size checking issues in the SDCA code.

Link: https://patch.msgid.link/20260722103500.872714-1-ckeepax@opensource.cirrus.com
This commit is contained in:
Mark Brown 2026-07-23 21:10:17 +01:00
commit 1a73896565
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
4 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sound/soc/sdca/sdca_device.c
View File

@ -43,7 +43,7 @@ void sdca_lookup_swft(struct sdw_slave *slave)
dev_info(&slave->dev, "SWFT not available\n");
else
devm_add_action_or_reset(&slave->dev, devm_acpi_table_put,
&slave->sdca_data.swft);
slave->sdca_data.swft);
}
EXPORT_SYMBOL_NS(sdca_lookup_swft, "SND_SOC_SDCA");

5
sound/soc/sdca/sdca_fdl.c
View File

@ -258,7 +258,8 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
if (!swf) {
dev_err(dev, "failed to locate SWF\n");
return -ENOENT;
ret = -ENOENT;
goto error;
}
dev_info(dev, "loading SWF: %x-%x-%x\n",
@ -270,6 +271,8 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,
SDCA_CTL_XU_FDL_MESSAGEOFFSET, fdl_file->fdl_offset,
SDCA_CTL_XU_FDL_MESSAGELENGTH, swf->data,
swf->file_length - offsetof(struct acpi_sw_file, data));
error:
release_firmware(firmware);
return ret;
}

2
sound/soc/sdca/sdca_functions.c
View File

@ -855,6 +855,8 @@ static int find_sdca_control_range(struct device *dev,
return 0;
else if (num_range < 0)
return num_range;
else if (num_range < 2 * sizeof(*limits))
return -EINVAL;
range_list = devm_kcalloc(dev, num_range, sizeof(*range_list), GFP_KERNEL);
if (!range_list)

4
sound/soc/sdca/sdca_ump.c
View File

@ -141,7 +141,7 @@ int sdca_ump_read_message(struct device *dev,
return ret;
}
if (msg_len > buf_len - msg_offset) {
if (msg_offset + msg_len > buf_len) {
dev_err(dev, "%s: message too big for UMP buffer: %d\n",
entity->label, msg_len);
return -EINVAL;
@ -207,7 +207,7 @@ int sdca_ump_write_message(struct device *dev,
buf_len = sdca_range(range, SDCA_MESSAGEOFFSET_BUFFER_LENGTH, 0);
ump_mode = sdca_range(range, SDCA_MESSAGEOFFSET_UMP_MODE, 0);
if (msg_len > buf_len - msg_offset) {
if (msg_offset + msg_len > buf_len) {
dev_err(dev, "%s: message too big for UMP buffer: %d\n",
entity->label, msg_len);
return -EINVAL;