From c04de2d88c0b2807b71480916a10adea83c85f02 Mon Sep 17 00:00:00 2001 From: Vijendar Mukunda Date: Wed, 1 Jul 2026 15:25:10 +0530 Subject: [PATCH] ASoC: SOF: amd: validate SizeFWSigned before signed FW length on ACP7x The ACP7.B/7.F ACPI signed path already reads SizeFWSigned from the image header into size_fw. Before adding ACP_IMAGE_HEADER_SIZE for SHA DMA, reject payload size zero or any size_fw with size_fw > fw_bin_size - ACP_IMAGE_HEADER_SIZE, so size_fw + ACP_IMAGE_HEADER_SIZE cannot exceed the supplied firmware buffer. Signed-off-by: Vijendar Mukunda Reviewed-by: Bard Liao Link: https://patch.msgid.link/20260701095759.1012929-10-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown --- sound/soc/sof/amd/acp-loader.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sound/soc/sof/amd/acp-loader.c b/sound/soc/sof/amd/acp-loader.c index e4a17e6656c0..76335c78255f 100644 --- a/sound/soc/sof/amd/acp-loader.c +++ b/sound/soc/sof/amd/acp-loader.c @@ -183,6 +183,13 @@ int acp_dsp_pre_fw_run(struct snd_sof_dev *sdev) } size_fw = get_unaligned_le32(adata->bin_buf + ACP_IMAGE_HDR_SIZE_FW_SIGNED_OFF); + if (!size_fw || + size_fw > adata->fw_bin_size - ACP_IMAGE_HEADER_SIZE) { + dev_err(sdev->dev, + "Invalid signed firmware payload size %u (max %u)\n", + size_fw, adata->fw_bin_size - ACP_IMAGE_HEADER_SIZE); + return -EINVAL; + } size_fw += ACP_IMAGE_HEADER_SIZE; } else { size_fw = adata->fw_bin_size;