diff options
| author | Ravindra Lokhande <rlokhande@nvidia.com> | 2017-05-08 14:42:48 +0530 |
|---|---|---|
| committer | Winnie Hsu <whsu@nvidia.com> | 2018-03-19 11:31:41 -0700 |
| commit | b6d6e5af1450ed5ccae042ab1125a6b799433b73 (patch) | |
| tree | 4b25d18b303ff3ddbffc6eb1d264144ffb65fbab /sound | |
| parent | 1357daf84c6e99b32c50ed39a524871d003d1886 (diff) | |
ASoC: tegra: check ucode upper limit
Check ucode size for upper limit.
Bug 1901435
Bug 1954563
Bug 1917589
Signed-off-by: Ravindra Lokhande <rlokhande@nvidia.com>
Signed-off-by: Xia Yang <xiay@nvidia.com>
Change-Id: I2f455771147bb4466d154878d2461e472647c4fb
Reviewed-on: https://git-master.nvidia.com/r/1575925
Reviewed-on: https://git-master.nvidia.com/r/1674399
GVS: Gerrit_Virtual_Submit
Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com>
Tested-by: James Huang <jamehuang@nvidia.com>
Reviewed-by: James Huang <jamehuang@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/tegra/tegra30_avp.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sound/soc/tegra/tegra30_avp.c b/sound/soc/tegra/tegra30_avp.c index 44d954561f96..a074e25614d1 100644 --- a/sound/soc/tegra/tegra30_avp.c +++ b/sound/soc/tegra/tegra30_avp.c @@ -256,7 +256,7 @@ static int tegra30_avp_load_ucode(void) struct audio_engine_data *audio_engine; const struct firmware *ucode_fw; const struct tegra30_avp_ucode_desc *ucode_desc; - int ucode_size = 0, ucode_offset = 0, total_ucode_size = 0; + ssize_t ucode_size = 0, ucode_offset = 0, total_ucode_size = 0; int i, ret = 0; dev_vdbg(audio_avp->dev, "%s", __func__); @@ -296,13 +296,14 @@ static int tegra30_avp_load_ucode(void) } ucode_size = ucode_fw->size; - if (ucode_size <= 0) { + if (ucode_size <= 0 || + ucode_size > avp_ucode_desc[i].max_mem_size) { dev_err(audio_avp->dev, "Invalid ucode size."); ret = -EINVAL; release_firmware(ucode_fw); goto err_param_mem_free; } - dev_vdbg(audio_avp->dev, "%s ucode size = %d bytes", + dev_vdbg(audio_avp->dev, "%s ucode size = %zd bytes", ucode_desc->bin_name, ucode_size); /* Read ucode */ |