github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-25 09:41:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ASoC: SOF: amd: validate SizeFWSigned before signed FW length on ACP7x

Browse Source 
The ACP7.B/7.F ACPI signed path already reads SizeFWSigned from the image
header into size_fw. Before adding ACP_IMAGE_HEADER_SIZE for SHA DMA,
reject payload size zero or any size_fw with size_fw > fw_bin_size -
ACP_IMAGE_HEADER_SIZE, so size_fw + ACP_IMAGE_HEADER_SIZE cannot exceed the
supplied firmware buffer.

Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260701095759.1012929-10-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Vijendar Mukunda 2026-07-01 15:25:10 +05:30 committed by Mark Brown
parent d6869ae07d
commit c04de2d88c
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sound/soc/sof/amd/acp-loader.c
View File

@ -183,6 +183,13 @@ int acp_dsp_pre_fw_run(struct snd_sof_dev *sdev)
}
size_fw = get_unaligned_le32(adata->bin_buf +
ACP_IMAGE_HDR_SIZE_FW_SIGNED_OFF);
if (!size_fw ||
size_fw > adata->fw_bin_size - ACP_IMAGE_HEADER_SIZE) {
dev_err(sdev->dev,
"Invalid signed firmware payload size %u (max %u)\n",
size_fw, adata->fw_bin_size - ACP_IMAGE_HEADER_SIZE);
return -EINVAL;
}
size_fw += ACP_IMAGE_HEADER_SIZE;
} else {
size_fw = adata->fw_bin_size;