firmware: cs_dsp: Fix overrun of unterminated control name string
authorRichard Fitzgerald <rf@opensource.cirrus.com>
Tue, 12 Apr 2022 16:39:27 +0000 (17:39 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 27 Apr 2022 12:40:57 +0000 (14:40 +0200)
commit07ab8ba8c7ad887a49151b6058384766ba5e84d1
tree8cddca286bd2b0a4cbfb94ccb8312447b94f26fd
parent71fbe889b7b277c83bdff7b31e84f22dfed54b45
firmware: cs_dsp: Fix overrun of unterminated control name string

[ Upstream commit 5b933c7262c5b0ea11ea3c3b3ea81add04895954 ]

For wmfw format v2 and later the coefficient name strings have a length
field and are NOT null-terminated. Use kasprintf() to convert the
unterminated string into a null-terminated string in an allocated buffer.

The previous code handled this duplication incorrectly using kmemdup()
and getting the length from a strlen() of the (unterminated) source string.
This resulted in creating a string that continued up to the next byte in
the firmware file that just happened to be 0x00.

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs")
Link: https://lore.kernel.org/r/20220412163927.1303470-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/firmware/cirrus/cs_dsp.c