github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ASoC: SDCA: Make UMP message size check more robust

Browse Source 
If message offset was larger than the buffer length the size
check will pass incorrectly. Refactor the check such that it is
more robust to invalid sizes.

Fixes: daab108504 ("ASoC: SDCA: Add UMP buffer helper functions")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Link: https://patch.msgid.link/20260722103500.872714-4-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Charles Keepax 2026-07-22 11:34:59 +01:00 committed by Mark Brown
parent 7f64ccc374
commit 556d872e7c
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sound/soc/sdca/sdca_ump.c
View File

@ -141,7 +141,7 @@ int sdca_ump_read_message(struct device *dev,
return ret;
}
if (msg_len > buf_len - msg_offset) {
if (msg_offset + msg_len > buf_len) {
dev_err(dev, "%s: message too big for UMP buffer: %d\n",
entity->label, msg_len);
return -EINVAL;
@ -207,7 +207,7 @@ int sdca_ump_write_message(struct device *dev,
buf_len = sdca_range(range, SDCA_MESSAGEOFFSET_BUFFER_LENGTH, 0);
ump_mode = sdca_range(range, SDCA_MESSAGEOFFSET_UMP_MODE, 0);
if (msg_len > buf_len - msg_offset) {
if (msg_offset + msg_len > buf_len) {
dev_err(dev, "%s: message too big for UMP buffer: %d\n",
entity->label, msg_len);
return -EINVAL;