Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e1e34edd authored by Xiaoyu Ye's avatar Xiaoyu Ye
Browse files

asoc: check param_size before use it in memcpy 



If param_size is not the correct size when it's
passed to memcpy, it could result wrong parameter
to be sent to ADSP by audio driver.

Change-Id: Iaf66a87c405bd0508bb0771c5fe20626f2b75dda
Signed-off-by: default avatarXiaoyu Ye <benyxy@codeaurora.org>
parent 6f1643ea

asoc/msm-lsm-client.c

+10 −2
Original line number Diff line number Diff line
@@ -881,8 +881,16 @@ static int msm_lsm_dereg_model(struct snd_pcm_substream *substream, 
		}



		if (sm->model_id == p_info->model_id) {

			if (p_info->param_size != sizeof(p_info->model_id)) {

				rc = -EINVAL;

				pr_err("%s: %s failed, p_info->param_size is invalid: %d\n",

				       __func__,  "LSM_DEREG_MULTI_SND_MODEL",

				       p_info->param_size);

			} else {

				rc = q6lsm_set_one_param(client, p_info, NULL,

							 LSM_DEREG_MULTI_SND_MODEL);

			}



			if (rc)

				dev_err(rtd->dev,

					"%s: Failed to deregister snd_model %d, err = %d\n",