mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 07:04:24 +00:00
ASoC: Intel: avs: Fix potential RX buffer overflow
If an event caused firmware to return invalid RX size for
LARGE_CONFIG_GET, memcpy_fromio() could end up copying too many bytes.
Fix by utilizing min_t().
Reported-by: CoolStar <coolstarorganization@gmail.com>
Fixes: f14a1c5a9f
("ASoC: Intel: avs: Add module management requests")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20221010121955.718168-3-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
parent
83375566a7
commit
23ae34e033
1 changed files with 2 additions and 1 deletions
|
@ -192,7 +192,8 @@ static void avs_dsp_receive_rx(struct avs_dev *adev, u64 header)
|
|||
/* update size in case of LARGE_CONFIG_GET */
|
||||
if (msg.msg_target == AVS_MOD_MSG &&
|
||||
msg.global_msg_type == AVS_MOD_LARGE_CONFIG_GET)
|
||||
ipc->rx.size = msg.ext.large_config.data_off_size;
|
||||
ipc->rx.size = min_t(u32, AVS_MAILBOX_SIZE,
|
||||
msg.ext.large_config.data_off_size);
|
||||
|
||||
memcpy_fromio(ipc->rx.data, avs_uplink_addr(adev), ipc->rx.size);
|
||||
trace_avs_msg_payload(ipc->rx.data, ipc->rx.size);
|
||||
|
|
Loading…
Reference in a new issue