github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ASoC: aw88395: use struct_size() and __counted_by() for aw_container

Browse Source 
The firmware container allocations passed cont->size + sizeof(int) to
kzalloc(), which was wrong: the struct contains an int len followed by a
u8 data[] flexible array. It ended up being the same as the struct's
size is only the int member but still wrong.

Use the modern struct_size helper for this.

Add __counted_by for extra runtime analysis.

Assisted-by: Claude:Opus-4.7
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260523011749.101555-1-rosenp@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Rosen Penev 2026-05-22 18:17:49 -07:00 committed by Mark Brown
parent 3a12998144
commit 36cf16513f
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
4 changed files with 23 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sound/soc/codecs/aw88081.c
View File

@ -1137,6 +1137,7 @@ static int aw88081_dev_init(struct aw88081 *aw88081, struct aw_container *aw_cfg
static int aw88081_request_firmware_file(struct aw88081 *aw88081)
{
const struct firmware *cont = NULL;
struct aw_container *aw_cfg;
int ret;
aw88081->aw_pa->fw_status = AW88081_DEV_FW_FAILED;
@ -1148,13 +1149,16 @@ static int aw88081_request_firmware_file(struct aw88081 *aw88081)
dev_dbg(aw88081->aw_pa->dev, "loaded %s - size: %zu\n",
AW88081_ACF_FILE, cont ? cont->size : 0);
aw88081->aw_cfg = devm_kzalloc(aw88081->aw_pa->dev, cont->size + sizeof(int), GFP_KERNEL);
if (!aw88081->aw_cfg) {
aw_cfg = devm_kzalloc(aw88081->aw_pa->dev, struct_size(aw_cfg, data, cont->size), GFP_KERNEL);
if (!aw_cfg) {
release_firmware(cont);
return -ENOMEM;
}
aw88081->aw_cfg->len = (int)cont->size;
memcpy(aw88081->aw_cfg->data, cont->data, cont->size);
aw_cfg->len = (int)cont->size;
memcpy(aw_cfg->data, cont->data, cont->size);
aw88081->aw_cfg = aw_cfg;
release_firmware(cont);
ret = aw88395_dev_load_acf_check(aw88081->aw_pa, aw88081->aw_cfg);

11
sound/soc/codecs/aw88261.c
View File

@ -1094,6 +1094,7 @@ static int aw88261_dev_init(struct aw88261 *aw88261, struct aw_container *aw_cfg
static int aw88261_request_firmware_file(struct aw88261 *aw88261)
{
const struct firmware *cont = NULL;
struct aw_container *aw_cfg;
const char *fw_name;
int ret;
@ -1111,15 +1112,17 @@ static int aw88261_request_firmware_file(struct aw88261 *aw88261)
dev_info(aw88261->aw_pa->dev, "loaded %s - size: %zu\n",
fw_name, cont ? cont->size : 0);
aw88261->aw_cfg = devm_kzalloc(aw88261->aw_pa->dev, cont->size + sizeof(int), GFP_KERNEL);
if (!aw88261->aw_cfg) {
aw_cfg = devm_kzalloc(aw88261->aw_pa->dev, struct_size(aw_cfg, data, cont->size), GFP_KERNEL);
if (!aw_cfg) {
release_firmware(cont);
return -ENOMEM;
}
aw88261->aw_cfg->len = (int)cont->size;
memcpy(aw88261->aw_cfg->data, cont->data, cont->size);
aw_cfg->len = (int)cont->size;
memcpy(aw_cfg->data, cont->data, cont->size);
release_firmware(cont);
aw88261->aw_cfg = aw_cfg;
ret = aw88395_dev_load_acf_check(aw88261->aw_pa, aw88261->aw_cfg);
if (ret) {
dev_err(aw88261->aw_pa->dev, "load [%s] failed !", fw_name);

11
sound/soc/codecs/aw88395/aw88395.c
View File

@ -462,6 +462,7 @@ static void aw88395_hw_reset(struct aw88395 *aw88395)
static int aw88395_request_firmware_file(struct aw88395 *aw88395)
{
const struct firmware *cont = NULL;
struct aw_container *aw_cfg;
int ret;
aw88395->aw_pa->fw_status = AW88395_DEV_FW_FAILED;
@ -475,15 +476,17 @@ static int aw88395_request_firmware_file(struct aw88395 *aw88395)
dev_info(aw88395->aw_pa->dev, "loaded %s - size: %zu\n",
AW88395_ACF_FILE, cont ? cont->size : 0);
aw88395->aw_cfg = devm_kzalloc(aw88395->aw_pa->dev, cont->size + sizeof(int), GFP_KERNEL);
if (!aw88395->aw_cfg) {
aw_cfg = devm_kzalloc(aw88395->aw_pa->dev, struct_size(aw_cfg, data, cont->size), GFP_KERNEL);
if (!aw_cfg) {
release_firmware(cont);
return -ENOMEM;
}
aw88395->aw_cfg->len = (int)cont->size;
memcpy(aw88395->aw_cfg->data, cont->data, cont->size);
aw_cfg->len = (int)cont->size;
memcpy(aw_cfg->data, cont->data, cont->size);
release_firmware(cont);
aw88395->aw_cfg = aw_cfg;
ret = aw88395_dev_load_acf_check(aw88395->aw_pa, aw88395->aw_cfg);
if (ret < 0) {
dev_err(aw88395->aw_pa->dev, "Load [%s] failed ....!", AW88395_ACF_FILE);

2
sound/soc/codecs/aw88395/aw88395_device.h
View File

@ -152,7 +152,7 @@ struct aw_cali_desc {
struct aw_container {
int len;
u8 data[];
u8 data[] __counted_by(len);
};
struct aw_device {