Merge "dsp: Add check for negative value size"

This commit is contained in:
qctecmdr 2023-03-24 03:14:32 -07:00 • committed by Gerrit - the friendly Code Review server
commit 3a37affb89

View file

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2014, 2016-2017, 2020-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/slab.h>
#include <linux/fs.h>
@ -416,7 +417,7 @@ static long audio_cal_shared_ioctl(struct file *file, unsigned int cmd,
pr_err("%s: Could not copy size value from user\n", __func__);
ret = -EFAULT;
goto done;
} else if ((size < sizeof(struct audio_cal_basic))
} else if ((size < 0) || (size < sizeof(struct audio_cal_basic))
|| (size > MAX_IOCTL_CMD_SIZE)) {
pr_err("%s: Invalid size sent to driver: %d, max size is %d, min size is %zd\n",
__func__, size, MAX_IOCTL_CMD_SIZE,