From f47869b550cbc8c98c8c80b37cc2107f4650ec38 Mon Sep 17 00:00:00 2001 From: Shalini Manjunatha Date: Tue, 16 May 2023 16:57:11 +0530 Subject: [PATCH 1/2] ASoC: msm-pcm-q6-v2: Add dsp buf check Fix is to add check for this ADSP returned buf offset + size, if it is within the available buf size range Change-Id: I400cc4f5c07164f0a9b405ebea144ea0ae4b6cf2 Signed-off-by: Shalini Manjunatha --- asoc/msm-pcm-q6-v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/asoc/msm-pcm-q6-v2.c b/asoc/msm-pcm-q6-v2.c index b26ae17520c7..bb19c4b7d386 100644 --- a/asoc/msm-pcm-q6-v2.c +++ b/asoc/msm-pcm-q6-v2.c @@ -1336,7 +1336,7 @@ static int msm_pcm_capture_copy(struct snd_pcm_substream *substream, goto fail; } - if (size == 0 || size < prtd->pcm_count) { + if ((size == 0 || size < prtd->pcm_count) && ((offset + size) < prtd->pcm_count)) { memset(bufptr + offset + size, 0, prtd->pcm_count - size); if (fbytes > prtd->pcm_count) size = xfer = prtd->pcm_count; From ba56a64009f00677a695bab5721f305e3f807ab5 Mon Sep 17 00:00:00 2001 From: Shalini Manjunatha Date: Fri, 23 Jun 2023 13:40:06 +0530 Subject: [PATCH 2/2] asoc:msm-lsm-client: check for param size before copying check for the proper param size before copying, to avoid OOB memory access of buffer. Change-Id: I8e9bd3b4be9a2797e76dce403578c038fc07dd58 Signed-off-by: Shalini Manjunatha --- asoc/msm-lsm-client.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c index b688d64a06ee..aa38e8c71490 100644 --- a/asoc/msm-lsm-client.c +++ b/asoc/msm-lsm-client.c @@ -782,6 +782,13 @@ static int msm_lsm_reg_model(struct snd_pcm_substream *substream, q6lsm_sm_set_param_data(client, p_info, &offset, sm); + if ((sm->size - offset) < p_info->param_size) { + dev_err(rtd->dev, "%s: user buff size is greater than expected\n", + __func__); + rc = -EINVAL; + goto err_copy; + } + /* * For set_param, advance the sound model data with the * number of bytes required by param_data.