Unverified Commit 9f4f42d7 authored Jun 13, 2019 by Cezary Rojewski Committed by Mark Brown Jun 25, 2019

ASoC: Intel: Common: Fix NULL dereference in tx_wait_done

rx_data and rx_bytes present for tx_wait_done are optional parameters.
If not provided, function should not attempt to copy received data.
This change fixes memcpy NULL pointer dereference issue occurring when
optional rx_data is NULL while received message size is non-zero.

Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>

parent 26ae2049

sound/soc/intel/common/sst-ipc.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -71,7 +71,7 @@ static int tx_wait_done(struct sst_generic_ipc *ipc,
		} else {

		/* copy the data returned from DSP */
		if (msg->rx_size)
		if (rx_data)
		memcpy(rx_data, msg->rx_data, msg->rx_size);
		ret = msg->errno;
		}