Merge "dsp: avtimer: validate payload size before memory copy" (8b6fa0c4) · Commits · e / devices / android_kernel_oneplus_sm7250

dsp/avtimer.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -89,6 +89,13 @@ static int32_t aprv2_core_fn_q(struct apr_client_data data, void priv)
		}

		payload1 = data->payload;

		if (data->payload_size < 2 * sizeof(uint32_t)) {
		pr_err("%s: payload has invalid size %d\n",
		__func__, data->payload_size);
		return -EINVAL;
		}

		switch (payload1[0]) {
		case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST:
		pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n",
		@@ -114,6 +121,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data data, void priv)
		}

		case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST:
		if (data->payload_size < sizeof(uint32_t)) {
		pr_err("%s: payload has invalid size %d\n",
		__func__, data->payload_size);
		return -EINVAL;
		}
		payload1 = data->payload;
		pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n",
		__func__, payload1[0]);