diff options
| author | Richard Fitzgerald <rf@opensource.cirrus.com> | 2022-04-12 17:39:27 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2022-04-12 17:57:04 +0100 |
| commit | 5b933c7262c5b0ea11ea3c3b3ea81add04895954 (patch) | |
| tree | 1e94e7eb10ac499ff298d646585ca7fd17d3fb35 | |
| parent | ddfd534528146660de75ee84d6db10f10e778f95 (diff) | |
| download | linux-stable-5b933c7262c5b0ea11ea3c3b3ea81add04895954.tar.gz linux-stable-5b933c7262c5b0ea11ea3c3b3ea81add04895954.tar.bz2 linux-stable-5b933c7262c5b0ea11ea3c3b3ea81add04895954.zip | |
firmware: cs_dsp: Fix overrun of unterminated control name string
For wmfw format v2 and later the coefficient name strings have a length
field and are NOT null-terminated. Use kasprintf() to convert the
unterminated string into a null-terminated string in an allocated buffer.
The previous code handled this duplication incorrectly using kmemdup()
and getting the length from a strlen() of the (unterminated) source string.
This resulted in creating a string that continued up to the next byte in
the firmware file that just happened to be 0x00.
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs")
Link: https://lore.kernel.org/r/20220412163927.1303470-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
| -rw-r--r-- | drivers/firmware/cirrus/cs_dsp.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c index e48108e694f8..7dad6f57d970 100644 --- a/drivers/firmware/cirrus/cs_dsp.c +++ b/drivers/firmware/cirrus/cs_dsp.c @@ -955,8 +955,7 @@ static int cs_dsp_create_control(struct cs_dsp *dsp, ctl->alg_region = *alg_region; if (subname && dsp->fw_ver >= 2) { ctl->subname_len = subname_len; - ctl->subname = kmemdup(subname, - strlen(subname) + 1, GFP_KERNEL); + ctl->subname = kasprintf(GFP_KERNEL, "%.*s", subname_len, subname); if (!ctl->subname) { ret = -ENOMEM; goto err_ctl; |