ASoC: SDCA: Make UMP message size check more robust

If message offset was larger than the buffer length the size
check will pass incorrectly. Refactor the check such that it is
more robust to invalid sizes.

Fixes: daab108504be ("ASoC: SDCA: Add UMP buffer helper functions")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Link: https://patch.msgid.link/20260722103500.872714-4-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/sdca/sdca_ump.c b/sound/soc/sdca/sdca_ump.c
index a86bb28c6d0ad99d9668ce4cf8ef5b740527d9ef..82a8bf75bbca5896b9d1687cb92ed2356c1d64f6 100644 (file)
--- a/sound/soc/sdca/sdca_ump.c
+++ b/sound/soc/sdca/sdca_ump.c
@@ -141,7 +141,7 @@ int sdca_ump_read_message(struct device *dev,
                return ret;
        }
 
-       if (msg_len > buf_len - msg_offset) {
+       if (msg_offset + msg_len > buf_len) {
                dev_err(dev, "%s: message too big for UMP buffer: %d\n",
                        entity->label, msg_len);
                return -EINVAL;
@@ -207,7 +207,7 @@ int sdca_ump_write_message(struct device *dev,
        buf_len = sdca_range(range, SDCA_MESSAGEOFFSET_BUFFER_LENGTH, 0);
        ump_mode = sdca_range(range, SDCA_MESSAGEOFFSET_UMP_MODE, 0);
 
-       if (msg_len > buf_len - msg_offset) {
+       if (msg_offset + msg_len > buf_len) {
                dev_err(dev, "%s: message too big for UMP buffer: %d\n",
                        entity->label, msg_len);
                return -EINVAL;