diff options
| author | Cezary Rojewski <cezary.rojewski@intel.com> | 2022-10-10 15:19:42 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-12-31 15:32:03 +0300 |
| commit | 0bad12fee5ae16ab439d97c66c4238f5f4cc7f68 (patch) | |
| tree | ee644c76ce9f29b050fcdf91061728c9f1afe429 /sound | |
| parent | b793142e7d6f780edd3e6e5a0d53accfd2c36672 (diff) | |
| download | linux-0bad12fee5ae16ab439d97c66c4238f5f4cc7f68.tar.xz | |
ASoC: Intel: avs: Fix potential RX buffer overflow
[ Upstream commit 23ae34e033b2c0e5e88237af82b163b296fd6aa9 ]
If an event caused firmware to return invalid RX size for
LARGE_CONFIG_GET, memcpy_fromio() could end up copying too many bytes.
Fix by utilizing min_t().
Reported-by: CoolStar <coolstarorganization@gmail.com>
Fixes: f14a1c5a9f83 ("ASoC: Intel: avs: Add module management requests")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20221010121955.718168-3-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/intel/avs/ipc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/soc/intel/avs/ipc.c b/sound/soc/intel/avs/ipc.c index 020d85c7520d..77da206f7dbb 100644 --- a/sound/soc/intel/avs/ipc.c +++ b/sound/soc/intel/avs/ipc.c @@ -192,7 +192,8 @@ static void avs_dsp_receive_rx(struct avs_dev *adev, u64 header) /* update size in case of LARGE_CONFIG_GET */ if (msg.msg_target == AVS_MOD_MSG && msg.global_msg_type == AVS_MOD_LARGE_CONFIG_GET) - ipc->rx.size = msg.ext.large_config.data_off_size; + ipc->rx.size = min_t(u32, AVS_MAILBOX_SIZE, + msg.ext.large_config.data_off_size); memcpy_fromio(ipc->rx.data, avs_uplink_addr(adev), ipc->rx.size); trace_avs_msg_payload(ipc->rx.data, ipc->rx.size); |