From bbe748c8dfa4de303462edaba96d4ce283c13bc7 Mon Sep 17 00:00:00 2001
From: Kumar Anurag Singh <quic_kumaranu@quicinc.com>
Date: Mon, 15 Apr 2024 00:50:50 -0700
Subject: [PATCH] dsp: q6lsm: Check size of payload before access

check size of payload before access in q6lsm_mmapcallback.

Change-Id: I6a755ca4cf54078f0d00f38e303f1b1da29b244c
Signed-off-by: Kumar Anurag Singh <quic_kumaranu@quicinc.com>
---
 dsp/q6lsm.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/dsp/q6lsm.c b/dsp/q6lsm.c
index e1aad637d8be..f79298d0c31d 100644
--- a/dsp/q6lsm.c
+++ b/dsp/q6lsm.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2013-2021, Linux Foundation. All rights reserved.
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/fs.h>
 #include <linux/mutex.h>
@@ -2130,6 +2130,12 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv)
 		return 0;
 	}
 
+	if (data->payload_size < (2 * sizeof(uint32_t))) {
+		pr_err("%s: payload has invalid size[%d]\n", __func__,
+			data->payload_size);
+		return -EINVAL;
+	}
+
 	command = payload[0];
 	retcode = payload[1];
 	sid = (data->token >> 8) & 0x0F;