From af708a82d11f762ceee49b2d519f63c835c9dc9a Mon Sep 17 00:00:00 2001 From: Aditya Bavanari Date: Fri, 8 Mar 2019 19:17:57 +0530 Subject: [PATCH] asoc: Fix invalid size pointer access in routing driver If data size is not greater than required size while getting topology in routing driver, it leads to invalid size pointer access. Add proper size check to avoid this. CRs-Fixed: 2384972 Change-Id: I8cd71a4ae866aca57c6d711cfd07e20c5edee3ae Signed-off-by: Aditya Bavanari --- asoc/msm-pcm-routing-v2.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/asoc/msm-pcm-routing-v2.c b/asoc/msm-pcm-routing-v2.c index 5a75609149d0..cf294b830e00 100644 --- a/asoc/msm-pcm-routing-v2.c +++ b/asoc/msm-pcm-routing-v2.c @@ -23917,6 +23917,11 @@ static uint32_t msm_routing_get_topology(size_t data_size, void *data) uint32_t size = 0; /* Retrieve cal_info size from cal data*/ + if (data_size < sizeof(struct audio_cal_type_basic) + + sizeof(struct audio_cal_info_adm_top)) { + pr_err("%s: Invalid data size: %zd\n", __func__, data_size); + goto done; + } size = data_size - sizeof(struct audio_cal_type_basic); cal_info = kzalloc(size, GFP_KERNEL);