From 83eb6201beb6fa15af26c0de7da5e4febb5fc9d3 Mon Sep 17 00:00:00 2001 From: Laxminath Kasam Date: Wed, 20 Jan 2021 11:17:22 +0530 Subject: [PATCH] asoc: Update copy_to_user to requested buffer size Avoid copy to user more than requested buffer size to avoid memory corruption. Change-Id: Ibf1607f777a358ebd16fd8b8728809afda34eba7 Signed-off-by: Laxminath Kasam --- asoc/msm-pcm-q6-v2.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/asoc/msm-pcm-q6-v2.c b/asoc/msm-pcm-q6-v2.c index c8114054d4d8..3d0bd0968729 100644 --- a/asoc/msm-pcm-q6-v2.c +++ b/asoc/msm-pcm-q6-v2.c @@ -1,5 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved. */ @@ -1017,7 +1017,10 @@ static int msm_pcm_capture_copy(struct snd_pcm_substream *substream, pr_debug("Offset value = %d\n", offset); if (size == 0 || size < prtd->pcm_count) { memset(bufptr + offset + size, 0, prtd->pcm_count - size); - size = xfer = prtd->pcm_count; + if (fbytes > prtd->pcm_count) + size = xfer = prtd->pcm_count; + else + size = xfer = fbytes; } if (copy_to_user(buf, bufptr+offset, xfer)) {