[PATCH 09/16] ASoC: SOF: amd: validate SizeFWSigned before signed FW length on ACP7x
From: Vijendar Mukunda
Date: Wed Jul 01 2026 - 06:02:20 EST
The ACP7.B/7.F ACPI signed path already reads SizeFWSigned from the image
header into size_fw. Before adding ACP_IMAGE_HEADER_SIZE for SHA DMA,
reject payload size zero or any size_fw with size_fw > fw_bin_size -
ACP_IMAGE_HEADER_SIZE, so size_fw + ACP_IMAGE_HEADER_SIZE cannot exceed the
supplied firmware buffer.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@xxxxxxx>
Reviewed-by: Bard Liao <yung-chuan.liao@xxxxxxxxxxxxxxx>
---
sound/soc/sof/amd/acp-loader.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/sound/soc/sof/amd/acp-loader.c b/sound/soc/sof/amd/acp-loader.c
index e4a17e6656c0..76335c78255f 100644
--- a/sound/soc/sof/amd/acp-loader.c
+++ b/sound/soc/sof/amd/acp-loader.c
@@ -183,6 +183,13 @@ int acp_dsp_pre_fw_run(struct snd_sof_dev *sdev)
}
size_fw = get_unaligned_le32(adata->bin_buf +
ACP_IMAGE_HDR_SIZE_FW_SIGNED_OFF);
+ if (!size_fw ||
+ size_fw > adata->fw_bin_size - ACP_IMAGE_HEADER_SIZE) {
+ dev_err(sdev->dev,
+ "Invalid signed firmware payload size %u (max %u)\n",
+ size_fw, adata->fw_bin_size - ACP_IMAGE_HEADER_SIZE);
+ return -EINVAL;
+ }
size_fw += ACP_IMAGE_HEADER_SIZE;
} else {
size_fw = adata->fw_bin_size;
--
2.45.2