ASoC: tas2783A: Fix issues in firmware parsing

During firmware download, if the size of the firmware is too small,
it wrongly assumes the firmware download is successful. If there is
size mismatch with chunk's header, invalid memory is accessed.
Fix these issues by throwing error during these cases.

Fixes: 4cc9bd8d7b32 (ASoc: tas2783A: Add soundwire based codec driver)
Reported-by: kernel test robot <[e-mail]>
Reported-by: Dan Carpenter <[e-mail]>
Closes: https://lore.kernel.org/r/[e-mail]/
Signed-off-by: Niranjan H Y <[e-mail]>
Link: https://patch.msgid.link/[e-mail]
Signed-off-by: Mark Brown <[e-mail]>

sound/soc/codecs/tas2783-sdw.c

···
 		goto out;
 	}
 
-	mutex_lock(&tas_dev->pde_lock);
 	img_sz = fmw->size;
 	buf = fmw->data;
 	offset += FW_DL_OFFSET;
+	if (offset >= (img_sz - FW_FL_HDR)) {
+		dev_err(tas_dev->dev,
+			"firmware is too small");
+		ret = -EINVAL;
+		goto out;
+	}
+
+	mutex_lock(&tas_dev->pde_lock);
 	while (offset < (img_sz - FW_FL_HDR)) {
 		memset(&hdr, 0, sizeof(hdr));
 		offset += read_header(&buf[offset], &hdr);
···
 			hdr.length, offset);
 		/* size also includes the header */
 		file_blk_size = hdr.length - FW_FL_HDR;
+
+		/* make sure that enough data is there */
+		if (offset + file_blk_size > img_sz) {
+			ret = -EINVAL;
+			dev_err(tas_dev->dev,
+				"corrupt firmware file");
+			break;
+		}
 
 		switch (hdr.file_id) {
 		case 0:
···
 			break;
 	}
 	mutex_unlock(&tas_dev->pde_lock);
-	tas2783_update_calibdata(tas_dev);
+	if (!ret)
+		tas2783_update_calibdata(tas_dev);
 
 out:
 	if (!ret)