diff mbox series

[5/7] ASoC: Intel: Common: Fix NULL dereference in tx_wait_done

Message ID 20190613190436.20156-6-cezary.rojewski@intel.com (mailing list archive)
State Accepted
Commit 9f4f42d710d417745cff05845f93370126f77ff7
Headers show
Series ASoC: Intel: Skylake: Critical IPC fixes and flow adjustments | expand

Commit Message

Cezary Rojewski June 13, 2019, 7:04 p.m. UTC 
From: Cezary Rojewski <cezary.rojewski@intel.com>

rx_data and rx_bytes present for tx_wait_done are optional parameters.
If not provided, function should not attempt to copy received data.
This change fixes memcpy NULL pointer dereference issue occurring when
optional rx_data is NULL while received message size is non-zero.

Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
---
 sound/soc/intel/common/sst-ipc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/sound/soc/intel/common/sst-ipc.c b/sound/soc/intel/common/sst-ipc.c
index dcff13802c00..fc3340f1da3a 100644
--- a/sound/soc/intel/common/sst-ipc.c
+++ b/sound/soc/intel/common/sst-ipc.c
@@ -71,7 +71,7 @@  static int tx_wait_done(struct sst_generic_ipc *ipc,
 	} else {
 
 		/* copy the data returned from DSP */
-		if (msg->rx_size)
+		if (rx_data)
 			memcpy(rx_data, msg->rx_data, msg->rx_size);
 		ret = msg->errno;
 	}