The response_buf was declared much larger (128 entries) than the number of responses that could ever be written into it (maximum 8).
Reduce response_buf to 8 entries and add checking in cdns_read_response() to prevent overflowing reponse_buf if CDNS_MCP_RX_FIFO_AVAIL contains an unexpectedly large number.
Signed-off-by: Richard Fitzgerald rf@opensource.cirrus.com --- drivers/soundwire/cadence_master.c | 6 ++++++ drivers/soundwire/cadence_master.h | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c index 27699f341f2c..95c84d9f0775 100644 --- a/drivers/soundwire/cadence_master.c +++ b/drivers/soundwire/cadence_master.c @@ -774,8 +774,14 @@ static void cdns_read_response(struct sdw_cdns *cdns) u32 num_resp, cmd_base; int i;
+ BUILD_BUG_ON(ARRAY_SIZE(cdns->response_buf) < CDNS_MCP_CMD_LEN); + num_resp = cdns_readl(cdns, CDNS_MCP_FIFOSTAT); num_resp &= CDNS_MCP_RX_FIFO_AVAIL; + if (num_resp > ARRAY_SIZE(cdns->response_buf)) { + dev_warn(cdns->dev, "RX AVAIL %d too long\n", num_resp); + num_resp = CDNS_MCP_CMD_LEN; + }
cmd_base = CDNS_MCP_CMD_BASE;
diff --git a/drivers/soundwire/cadence_master.h b/drivers/soundwire/cadence_master.h index 0434d70d4b1f..c2d817e8e22a 100644 --- a/drivers/soundwire/cadence_master.h +++ b/drivers/soundwire/cadence_master.h @@ -117,7 +117,7 @@ struct sdw_cdns { struct sdw_bus bus; unsigned int instance;
- u32 response_buf[0x80]; + u32 response_buf[8]; struct completion tx_complete; struct sdw_defer *defer;