]> git.baikalelectronics.ru Git - kernel.git/commit
ASoC: SOF: ipc-msg-injector: Cap the rmaining to count in IPC4 mode
authorPeter Ujfalusi <peter.ujfalusi@linux.intel.com>
Mon, 16 May 2022 09:24:42 +0000 (12:24 +0300)
committerMark Brown <broonie@kernel.org>
Tue, 17 May 2022 10:58:11 +0000 (11:58 +0100)
commit427c93cc3fbb99a05e6dbac26e6c5c48796b4974
treeb5135b98c552761d574d121b2e3341c261f9f340
parentb6d18ebede912d813925540e324ea5f9984747c6
ASoC: SOF: ipc-msg-injector: Cap the rmaining to count in IPC4 mode

If user space provides smaller buffer than the IPC4 reply then it is
possible that we corrupt user space memory since the IPC4 dfs_read function
is not using the count directly in copy_to_user() due to the nature of
an IPC4 message.

Cap the remaining counter to make sure that we are not writing too much to
the user space provided buffer.

Add a check also to make sure that the buffer is at least the size of the
IPC4 header.

Fixes: 73bffe328996: "ASoC: SOF: ipc-msg-injector: Add support for IPC4 messages"
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://lore.kernel.org/r/20220516092442.17027-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
sound/soc/sof/sof-client-ipc-msg-injector.c