diff options
| author | Steve Lee <steves.lee@maximintegrated.com> | 2020-06-04 08:47:31 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2020-06-04 17:04:30 +0300 |
| commit | 97ed3e509ee6d098730d137759c627a8d674cf55 (patch) | |
| tree | 7882c3fd83288bd028efc71061439ddf7d3060e3 /sound/soc/codecs/max98390.h | |
| parent | 678916ec54f38406032462dc466fd36cdfea4e3c (diff) | |
| download | linux-97ed3e509ee6d098730d137759c627a8d674cf55.tar.xz | |
ASoC: max98390: Fix potential crash during param fw loading
malformed firmware file can cause out-of-bound access and crash
during dsm_param bin loading.
- add MIN/MAX param size to avoid out-of-bound access.
- read start addr and size of param and check bound.
- add condition that fw->size > param_size + _PAYLOAD_OFFSET
to confirm enough data.
Signed-off-by: Steve Lee <steves.lee@maximintegrated.com>
Link: https://lore.kernel.org/r/20200604054731.21140-1-steves.lee@maximintegrated.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/codecs/max98390.h')
| -rw-r--r-- | sound/soc/codecs/max98390.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/soc/codecs/max98390.h b/sound/soc/codecs/max98390.h index f59cb114d957..5f444e7779b0 100644 --- a/sound/soc/codecs/max98390.h +++ b/sound/soc/codecs/max98390.h @@ -650,7 +650,8 @@ /* DSM register offset */ #define MAX98390_DSM_PAYLOAD_OFFSET 16 -#define MAX98390_DSM_PAYLOAD_OFFSET_2 495 +#define MAX98390_DSM_PARAM_MAX_SIZE 770 +#define MAX98390_DSM_PARAM_MIN_SIZE 670 struct max98390_priv { struct regmap *regmap; |