]> git.baikalelectronics.ru Git - kernel.git/commit
ASoC: SOF: ipc-msg-injector: fix copy in sof_msg_inject_ipc4_dfs_write()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 8 Jul 2022 13:48:36 +0000 (16:48 +0300)
committerMark Brown <broonie@kernel.org>
Thu, 14 Jul 2022 12:26:37 +0000 (13:26 +0100)
commit64edca1afcc7be54859c9b2b83f7255f1315a18b
tree7041574d6dda9ec033628dd2fdeb5827c50d2615
parent1ec6ff1edcbf646c98ec0d354da548ee0b7b5168
ASoC: SOF: ipc-msg-injector: fix copy in sof_msg_inject_ipc4_dfs_write()

There are two bugs that have to do with when we copy the payload:

size = simple_write_to_buffer(ipc4_msg->data_ptr,
      priv->max_msg_size, ppos, buffer,
      count);

The value of "*ppos" was supposed to be zero but it is
sizeof(ipc4_msg->header_u64) so it will copy the data into the middle of
the "ipc4_msg->data_ptr" buffer instead of to the start.  The second
problem is "buffer" should be "buffer + sizeof(ipc4_msg->header_u64)".

This function is used for fuzz testing so the data is normally random
and this bug likely does not affect anyone very much.

In this context, it's simpler and more appropriate to use copy_from_user()
instead of simple_write_to_buffer() so I have re-written the function.

Fixes: 73bffe328996 ("ASoC: SOF: ipc-msg-injector: Add support for IPC4 messages")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/Ysg1tB2FKLnRMsel@kili
Signed-off-by: Mark Brown <broonie@kernel.org>
sound/soc/sof/sof-client-ipc-msg-injector.c