summaryrefslogtreecommitdiff
path: root/sound
diff options
context:
space:
mode:
authorVinod Koul <vinod.koul@intel.com>2016-02-03 17:59:44 +0530
committerMark Brown <broonie@kernel.org>2016-02-04 11:36:14 +0000
commit41556f68d1dd0b6bbf311a220523b034d2a040e7 (patch)
tree4a9a5c0c3ba379e4c755b814ecfbb112d40ab2f9 /sound
parent292d4200a90715ac29f3763df27adb38a243868c (diff)
ASoC: Intel: Skylake: Fix the memory overwrite of tlv buffer
TLV buffer can be smaller than the module data, so update the size of data to be copied before doing the copy. Also TLV header consists of two unsigned ints, this is also taken into account here and size modified to reflect this Suggested-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound')
-rw-r--r--sound/soc/intel/skylake/skl-topology.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index c7816d52ad08..c67e3acb8102 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -916,6 +916,13 @@ static int skl_tplg_tlv_control_get(struct snd_kcontrol *kcontrol,
skl_get_module_params(skl->skl_sst, (u32 *)bc->params,
bc->max, bc->param_id, mconfig);
+ /* decrement size for TLV header */
+ size -= 2 * sizeof(u32);
+
+ /* check size as we don't want to send kernel data */
+ if (size > bc->max)
+ size = bc->max;
+
if (bc->params) {
if (copy_to_user(data, &bc->param_id, sizeof(u32)))
return -EFAULT;