diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2019-02-28 22:47:17 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-02-28 22:47:16 -0800 |
| commit | e93fe31e7a61afa385f171c1d26c2e0f26276c24 (patch) | |
| tree | fa6334c1d2e33df7177235ecad177608a55ad64e /drivers/misc | |
| parent | ae4efa3cc1a4a8a45fe1ea6e38453fbd73de350d (diff) | |
| parent | afc89f6f2b7f45b42bba57c09c8551cf193b6cfb (diff) | |
Merge "qdsp6v2: q6usm: Check size of payload before access"
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c b/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c index 654252ffec60..127de5440196 100644 --- a/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c +++ b/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c @@ -507,6 +507,12 @@ static int32_t q6usm_mmapcallback(struct apr_client_data *data, void *priv) uint32_t token; uint32_t *payload = data->payload; + if (data->payload_size < (2 * sizeof(uint32_t))) { + pr_err("%s: payload has invalid size[%d]\n", __func__, + data->payload_size); + return -EINVAL; + } + pr_debug("%s: ptr0[0x%x]; ptr1[0x%x]; opcode[0x%x]\n", __func__, payload[0], payload[1], data->opcode); pr_debug("%s: token[0x%x]; payload_size[%d]; src[%d]; dest[%d];\n", |