Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8496c66a authored by Vicky Sehrawat's avatar Vicky Sehrawat
Browse files

ASoC: msm: Fix for passing correct data to userspace 



The Copy_to_user function copies the whole frame structure
to the userspace. Only len bytes should be copied.
As the whole frame is being copied
(HPCM_MAX_VOC_PKT_SIZE bytes) the uninitialized bytes
in the buffer will be disclosed to the calling
user-space process.

Change-Id: I7d7f58d358aaf56d91a79cfe95c04d937b48da53
Signed-off-by: default avatarVicky Sehrawat <vickys@codeaurora.org>
parent 13d2d953

sound/soc/msm/msm-pcm-host-voice.c

+1 −1
Original line number Diff line number Diff line
@@ -989,7 +989,7 @@ static int msm_pcm_capture_copy(struct snd_pcm_substream *substream, 
			spin_unlock_irqrestore(&dai_data->dsp_lock, dsp_flags);

			ret = copy_to_user(buf,

					   &buf_node->frame.voc_pkt,

					   count);

					   buf_node->frame.len);

			if (ret) {

				pr_err("%s: Copy to user retuned %d\n",

					__func__, ret);

sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c

+1 −1
Original line number Diff line number Diff line
@@ -1027,7 +1027,7 @@ static int msm_pcm_capture_copy(struct snd_pcm_substream *substream, 
			list_del(&buf_node->list);

			spin_unlock_irqrestore(&dai_data->dsp_lock, dsp_flags);

			ret = copy_to_user(buf, &buf_node->frame.voc_pkt,

					   count);

					   buf_node->frame.len);

			if (ret) {

				pr_err("%s: Copy to user retuned %d\n",

					__func__, ret);