ASoC: msm: check payload size before memory allocation

Buffer from mixer ctl or ADSP is composed of payload size and
actual payload. On a 32 bit platform, we could have an overflow
if payload size is below UINT_MAX while payload size + sizeof(struct)
is over UINT_MAX. Allocated memory size would be less than expected.
Check payload size against limit before memory allocation.

Change-Id: I0bf19ca7b8c93083177a21ad726122dc20f45551
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>

diff --git a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
index 15134a0..69951e1 100644 (file)
--- a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
@@ -3748,9 +3748,8 @@ static int msm_compr_adsp_stream_cmd_put(struct snd_kcontrol *kcontrol,
                goto done;
        }
 
-
-       if ((sizeof(struct msm_adsp_event_data) + event_data->payload_len) >=
-                                       sizeof(ucontrol->value.bytes.data)) {
+       if (event_data->payload_len > sizeof(ucontrol->value.bytes.data)
+                        - sizeof(struct msm_adsp_event_data)) {
                pr_err("%s param length=%d  exceeds limit",
                        __func__, event_data->payload_len);
                ret = -EINVAL;

diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c
index a0364bb..be99f16 100644 (file)
--- a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c
@@ -1165,8 +1165,8 @@ static int msm_pcm_adsp_stream_cmd_put(struct snd_kcontrol *kcontrol,
                goto done;
        }
 
-       if ((sizeof(struct msm_adsp_event_data) + event_data->payload_len) >=
-                                       sizeof(ucontrol->value.bytes.data)) {
+       if (event_data->payload_len > sizeof(ucontrol->value.bytes.data)
+                       - sizeof(struct msm_adsp_event_data)) {
                pr_err("%s param length=%d  exceeds limit",
                        __func__, event_data->payload_len);
                ret = -EINVAL;

diff --git a/sound/soc/msm/qdsp6v2/msm-qti-pp-config.c b/sound/soc/msm/qdsp6v2/msm-qti-pp-config.c
index 1ddb384..e890e6a 100644 (file)
--- a/sound/soc/msm/qdsp6v2/msm-qti-pp-config.c
+++ b/sound/soc/msm/qdsp6v2/msm-qti-pp-config.c
@@ -982,8 +982,9 @@ int msm_adsp_inform_mixer_ctl(struct snd_soc_pcm_runtime *rtd,
 
        event_data = (struct msm_adsp_event_data *)payload;
        kctl->info(kctl, &kctl_info);
-       if (sizeof(struct msm_adsp_event_data)
-               + event_data->payload_len > kctl_info.count) {
+
+       if (event_data->payload_len >
+               kctl_info.count - sizeof(struct msm_adsp_event_data)) {
                pr_err("%s: payload length exceeds limit of %u bytes.\n",
                        __func__, kctl_info.count);
                ret = -EINVAL;

diff --git a/sound/soc/msm/qdsp6v2/msm-transcode-loopback-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-transcode-loopback-q6-v2.c
index 72dd751..3b53614 100644 (file)
--- a/sound/soc/msm/qdsp6v2/msm-transcode-loopback-q6-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-transcode-loopback-q6-v2.c
@@ -692,9 +692,8 @@ static int msm_transcode_stream_cmd_put(struct snd_kcontrol *kcontrol,
                goto done;
        }
 
-
-       if ((sizeof(struct msm_adsp_event_data) + event_data->payload_len) >=
-                                       sizeof(ucontrol->value.bytes.data)) {
+       if (event_data->payload_len > sizeof(ucontrol->value.bytes.data)
+               - sizeof(struct msm_adsp_event_data)) {
                pr_err("%s param length=%d  exceeds limit",
                         __func__, event_data->payload_len);
                ret = -EINVAL;