From acb96a6c93e79f60613586aef81783201451c3e9 Mon Sep 17 00:00:00 2001 From: Raza Kamal Date: Mon, 4 Dec 2023 15:33:09 +0530 Subject: [PATCH] Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase. size = sizeof(p_info_32) + p_info_32.param_size; This overflow issue may result heap overflow during copying the data: memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32)); The validation check is added so that heap overflow can be avoided. Change-Id: I11dcbe7ebb33e349dfd9f347f3ef25bc781075fc Signed-off-by: Raza Kamal --- asoc/msm-lsm-client.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c index 860ad10e79d3..443f62e84d01 100644 --- a/asoc/msm-lsm-client.c +++ b/asoc/msm-lsm-client.c @@ -2379,8 +2379,13 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, prtd->lsm_client->get_param_payload = NULL; goto done; } + if (__builtin_uadd_overflow(sizeof(p_info_32), p_info_32.param_size, &size)) { + pr_err("%s: param size exceeds limit of %u bytes.\n", + __func__, UINT_MAX); + err = -EINVAL; + goto done; + } - size = sizeof(p_info_32) + p_info_32.param_size; param_info_rsp = kzalloc(size, GFP_KERNEL); if (!param_info_rsp) {