From 2bec615f5c58bc8e7ecffdb6feabcd7cd10b059b Mon Sep 17 00:00:00 2001
From: Shimana P <quic_shimp@quicinc.com>
Date: Fri, 19 Jul 2024 14:40:57 +0530
Subject: [PATCH] asoc: msm-lsm-client: check for param size before copying

check for the proper param size before copying,
to avoid buffer overflow.

Change-Id: I3e41439fb747aeebe7677b32c768aea19fcea37c
Signed-off-by: Shimana P <quic_shimp@quicinc.com>
---
 asoc/msm-lsm-client.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c
index 9b82d8c49a51..bd9b73571263 100644
--- a/asoc/msm-lsm-client.c
+++ b/asoc/msm-lsm-client.c
@@ -830,6 +830,13 @@ static int msm_lsm_reg_model(struct snd_pcm_substream *substream,
 
 		q6lsm_sm_set_param_data(client, p_info, &offset, sm);
 
+		if ((sm->size - offset) < p_info->param_size) {
+			dev_err(rtd->dev, "%s: user buff size is greater than expected\n",
+				__func__);
+			rc = -EINVAL;
+			goto err_copy;
+		}
+
 		/*
 		 * For set_param, advance the sound model data with the
 		 * number of bytes required by param_data.