diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-07-04 01:21:01 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-04 01:21:01 -0700 |
| commit | 8775c10a30afd1d84b5665831699dbf6bb0ad08a (patch) | |
| tree | 36eba6d1d0d68233d434593418a60e2649104edc /sound/soc/msm/qdsp6v2 | |
| parent | 8661bf1cf393b50f88b711c2df499d720272150c (diff) | |
| parent | 8914f7b8616daec323016b0e5a9920e7501ef6e9 (diff) | |
Merge "ASoC: msm: qdsp6v2: add size check to fix out of bounds issue"
Diffstat (limited to 'sound/soc/msm/qdsp6v2')
| -rw-r--r-- | sound/soc/msm/qdsp6v2/audio_calibration.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/sound/soc/msm/qdsp6v2/audio_calibration.c b/sound/soc/msm/qdsp6v2/audio_calibration.c index 60d09dfaeb7f..2a1b34776b68 100644 --- a/sound/soc/msm/qdsp6v2/audio_calibration.c +++ b/sound/soc/msm/qdsp6v2/audio_calibration.c @@ -453,6 +453,12 @@ static long audio_cal_shared_ioctl(struct file *file, unsigned int cmd, data->cal_type.cal_hdr.buffer_number); ret = -EINVAL; goto done; + } else if ((data->hdr.cal_type_size + sizeof(data->hdr)) > size) { + pr_err("%s: cal type hdr size %zd + cal type size %d is greater than user buffer size %d\n", + __func__, sizeof(data->hdr), data->hdr.cal_type_size, + size); + ret = -EFAULT; + goto done; } @@ -490,13 +496,7 @@ static long audio_cal_shared_ioctl(struct file *file, unsigned int cmd, goto unlock; if (data == NULL) goto unlock; - if ((sizeof(data->hdr) + data->hdr.cal_type_size) > size) { - pr_err("%s: header size %zd plus cal type size %d are greater than data buffer size %d\n", - __func__, sizeof(data->hdr), - data->hdr.cal_type_size, size); - ret = -EFAULT; - goto unlock; - } else if (copy_to_user((void *)arg, data, + if (copy_to_user(arg, data, sizeof(data->hdr) + data->hdr.cal_type_size)) { pr_err("%s: Could not copy cal type to user\n", __func__); |