diff options
| author | Soumya Managoli <quic_c_smanag@quicinc.com> | 2023-11-28 16:12:58 +0530 |
|---|---|---|
| committer | Sambandam Chitra <quic_schitra@quicinc.com> | 2023-12-05 23:28:39 -0800 |
| commit | ffd5887a21a52729ff3262c173253bbc7483877f (patch) | |
| tree | f8f3d61a16593283976e9a00352137047c1a9709 | |
| parent | e4d16ada80f2b65bc5d3ad08005f600ebcc702be (diff) | |
dsp: q6asm: Add check for ADSP payload size
There is no check for the ADSP returned payload size
for ASM_SESSION_CMD_GET_MTMX_STRTR_PARAMS_V2 cmd response.
This can lead to buffer overread. Fix is to address this.
Change-Id: I0bd6ee7f19823addc5dde1dfbb32b8a9b102a725
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| -rw-r--r-- | sound/soc/msm/qdsp6v2/q6asm.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sound/soc/msm/qdsp6v2/q6asm.c b/sound/soc/msm/qdsp6v2/q6asm.c index 987c1cc099f8..91854735bb0f 100644 --- a/sound/soc/msm/qdsp6v2/q6asm.c +++ b/sound/soc/msm/qdsp6v2/q6asm.c @@ -12,6 +12,7 @@ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * + * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved. */ #include <linux/fs.h> #include <linux/mutex.h> @@ -2391,6 +2392,14 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) __func__, data->payload_size); break; case ASM_SESSION_CMDRSP_GET_MTMX_STRTR_PARAMS_V2: + payload_size = sizeof(struct asm_mtmx_strtr_get_params_cmdrsp); + if (data->payload_size < payload_size) { + pr_err("%s: insufficient payload size = %d\n", + __func__, data->payload_size); + spin_unlock_irqrestore( + &(session[session_id].session_lock), flags); + return -EINVAL; + } q6asm_process_mtmx_get_param_rsp(ac, (void *) payload); break; case ASM_STREAM_PP_EVENT: |