From nobody Sun Feb 8 03:27:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6954C05052 for ; Mon, 7 Aug 2023 07:52:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231532AbjHGHwa (ORCPT ); Mon, 7 Aug 2023 03:52:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231509AbjHGHwA (ORCPT ); Mon, 7 Aug 2023 03:52:00 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B70871708 for ; Mon, 7 Aug 2023 00:51:52 -0700 (PDT) Received: from kwepemi500009.china.huawei.com (unknown [172.30.72.56]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4RK7k62zMtz1Z1Yq; Mon, 7 Aug 2023 15:49:02 +0800 (CST) Received: from huawei.com (10.67.175.85) by kwepemi500009.china.huawei.com (7.221.188.199) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Mon, 7 Aug 2023 15:51:49 +0800 From: Xia Fukun To: , , , , , , , , CC: , Subject: [PATCH] ASoC: SOF: Fix incorrect use of sizeof in sof_ipc3_do_rx_work() Date: Mon, 7 Aug 2023 15:51:18 +0800 Message-ID: <20230807075118.128122-1-xiafukun@huawei.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.67.175.85] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To kwepemi500009.china.huawei.com (7.221.188.199) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Here hdr is a pointer, and we should measure the size of struct sof_ipc_cmd_hdr. Fixes: 12c41c779fad ("ASoC: SOF: Refactor rx function for fuzzing") Signed-off-by: Xia Fukun Reviewed-by: Curtis Malainey --- sound/soc/sof/ipc3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/sof/ipc3.c b/sound/soc/sof/ipc3.c index 2c5aac31e8b0..580960ff273d 100644 --- a/sound/soc/sof/ipc3.c +++ b/sound/soc/sof/ipc3.c @@ -1001,7 +1001,7 @@ void sof_ipc3_do_rx_work(struct snd_sof_dev *sdev, st= ruct sof_ipc_cmd_hdr *hdr, =20 ipc3_log_header(sdev->dev, "ipc rx", hdr->cmd); =20 - if (hdr->size < sizeof(hdr) || hdr->size > SOF_IPC_MSG_MAX_SIZE) { + if (hdr->size < sizeof(*hdr) || hdr->size > SOF_IPC_MSG_MAX_SIZE) { dev_err(sdev->dev, "The received message size is invalid: %u\n", hdr->size); return; --=20 2.17.1