From 7756692d5419f47792b778f9cc4a43d468d0bee8 Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Wed, 12 Apr 2023 14:27:28 +0530 Subject: [PATCH] ASoC: msm-pcm-host-voice: Address buffer overflow in hpcm capture copy There is no check for the copy data size of the ADSP returned payload. Add check for the max hpcm_buf_node size before copy to avoid buffer out of bounds issue. Change-Id: Id647888430ce302359a857ef54d321bee99889bf Signed-off-by: Soumya Managoli --- asoc/msm-pcm-host-voice-v2.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/asoc/msm-pcm-host-voice-v2.c b/asoc/msm-pcm-host-voice-v2.c index 4496e05a966a..b3100414af3a 100644 --- a/asoc/msm-pcm-host-voice-v2.c +++ b/asoc/msm-pcm-host-voice-v2.c @@ -683,6 +683,12 @@ static void hpcm_copy_capture_data_to_queue(struct dai_data *dai_data, if (dai_data->substream == NULL) return; + if (len >= HPCM_MAX_VOC_PKT_SIZE) { + pr_err("%s: Copy capture data len %d is > HPCM_MAX_VOC_PKT_SIZE\n", + __func__, len); + return; + } + /* Copy out buffer packet into free_queue */ spin_lock_irqsave(&dai_data->dsp_lock, dsp_flags);