diff options
| author | Vatsal Bucha <vbucha@codeaurora.org> | 2019-02-12 13:07:27 +0530 |
|---|---|---|
| committer | Vatsal Bucha <vbucha@codeaurora.org> | 2019-02-15 12:38:16 +0530 |
| commit | afc89f6f2b7f45b42bba57c09c8551cf193b6cfb (patch) | |
| tree | 4e21ff97d0ceddfce9b2158dc1624eeccd16afc5 | |
| parent | 7e7b058fc8af86447fd049af7221bdaaecf2b13b (diff) | |
qdsp6v2: q6usm: Check size of payload before access
Check size of payload before access in q6usm_mmapcallback.
Change-Id: Iff0672532c2ea40e7129237a92d8365d6b554cf2
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
| -rw-r--r-- | drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c b/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c index 654252ffec60..127de5440196 100644 --- a/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c +++ b/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c @@ -507,6 +507,12 @@ static int32_t q6usm_mmapcallback(struct apr_client_data *data, void *priv) uint32_t token; uint32_t *payload = data->payload; + if (data->payload_size < (2 * sizeof(uint32_t))) { + pr_err("%s: payload has invalid size[%d]\n", __func__, + data->payload_size); + return -EINVAL; + } + pr_debug("%s: ptr0[0x%x]; ptr1[0x%x]; opcode[0x%x]\n", __func__, payload[0], payload[1], data->opcode); pr_debug("%s: token[0x%x]; payload_size[%d]; src[%d]; dest[%d];\n", |